CVE-2026-70280: Windows Hello Security Feature Bypass Vulnerability
Incorrect authorization in Windows Hello allows an authorized attacker to bypass a security feature locally.
Other sources
Windows Hello Security Feature Bypass Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.28000.3231Patch KB5127646 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26200.9711Patch KB5127648 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26300.9711Patch KB5127648 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.9711Patch KB5127648 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.22631.7652Patch KB5126653 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.19044.7807Patch KB5126657
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must already be authorized and have high privileges on the affected system. Exploitation is local and does not require user interaction.
Which systems are identified as affected?
The affected software listed is Microsoft Windows 10 and Microsoft Windows 11. The provided information does not identify specific affected versions or build numbers.
What is the likely security impact of successful exploitation?
Successful exploitation can bypass a Windows Hello security feature and has a high confidentiality impact. No integrity or availability impact is indicated by the supplied severity vector.