CVE-2026-26175 Microsoft CVE debrief

Who should care

Defenders should care about this vulnerability as it allows an attacker with physical access to bypass a security feature in the Windows Boot Manager. Roles that should assess exposure include system administrators, security teams, and IT personnel responsible for patch management and vulnerability assessment. Deployment contexts that should assess exposure include all Windows systems, especially those exposed to physical access.

Why it matters

CVE-2026-26175 is a security feature bypass vulnerability in the Windows Boot Manager that requires patching to prevent potential exploitation by attackers with physical access. Defenders should prioritize patch deployment, assess exposure, monitor for suspicious activity, and inventory vulnerable systems.

• Verify patch deployment priority for Windows Boot Manager.
• Assess exposure of Windows systems to physical attacks.
• Monitor for unusual boot-related activity.
• Inventory systems for vulnerability.

Technical summary

The vulnerability exists in the Windows Boot Manager, allowing an unauthorized attacker to bypass a security feature with a physical attack. Affected versions include Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows 11 version 23H2, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows 11 Version 25H2, Windows 11 version 26H1, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025.

Defensive priority

Apply patches from Microsoft to vulnerable systems, especially those exposed to physical access.

Recommended defensive actions

• Apply patches from Microsoft to vulnerable systems, especially those exposed to physical access.
• Inventory systems for exposure, focusing on Windows versions listed as affected.
• Monitor for unusual boot-related activity that could indicate exploitation attempts.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Microsoft has an advisory for this issue. The vulnerability exists in the Windows Boot Manager, allowing an unauthorized attacker to bypass a security feature with a physical attack. Affected versions include Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows 11 version 23H2, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows 11 Version 25H2, Windows 11 26H

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.