Firmware Security Bypass Vulnerability in Windows 10 and 11
CVE-2026-116638

7.5HIGH

Key Information:

Vendor

Microsoft
Status
Windows Recovery Environment (WinRE)
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116638?

The Windows Recovery Environment (WinRE) in both Windows 10 and 11 has a vulnerability that could allow an attacker with physical or administrative access to bypass established firmware security controls. This includes circumventing UEFI/BIOS passwords set by administrators. Taking advantage of WinRE's boot mechanisms, a malicious actor could potentially gain unauthorized access to system resources, compromising the integrity and security of affected systems.

References

https://kb.cert.org/vuls/id/226679
https://beafn28.es/articulos/winre-uefi-bypass

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.