Is CVE-2026-116638 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116638 being exploited in the wild.

How severe is CVE-2026-116638?

Informational severity, published 26 October 2026.

Which products and versions are affected?

Microsoft Windows 10; Microsoft Windows 11.

How is CVE-2026-116638 attacked?

It is attacked with physical access or with local access, in an operating system.

Am I affected by CVE-2026-116638?

Check whether you run Microsoft Windows 11 or Microsoft Windows 10. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116638: Microsoft Windows Recovery Environment UEFI/BIOS password bypass

CVE-2026-116638 · Severity: info · Published 2026-10-26

Windows Recovery Environment (WinRE) in Windows 10 and 11 may not enforce firmware security protections consistently during recovery operations. An attacker with physical access to a device or administrative privileges could bypass UEFI/BIOS password protections and potentially circumvent BitLocker encryption, gaining unauthorized access to sensitive data on the system.

Technologies: Microsoft Windows 11, Microsoft Windows 10. Vendors: Microsoft.

Quick answers

Is CVE-2026-116638 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116638 being exploited in the wild.
How severe is CVE-2026-116638?: Informational severity, published 26 October 2026.
Which products and versions are affected?: Microsoft Windows 10; Microsoft Windows 11.
Is there a fix for CVE-2026-116638?: No fixed version is recorded yet. Disable or restrict WinRE on systems where recovery functionality is not required. Enable BitLocker with TPM + PIN or TPM + Startup Key for additional authentication during recovery. Restrict modifications to UEFI NVRAM variables (BootNext, BootOrder) and implement physical security controls including device locks and tamper-evident protections on high-value systems. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-116638 attacked?: It is attacked with physical access or with local access, in an operating system.
Am I affected by CVE-2026-116638?: Check whether you run Microsoft Windows 11 or Microsoft Windows 10. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Disable or restrict WinRE on systems where recovery functionality is not required. Enable BitLocker with TPM + PIN or TPM + Startup Key for additional authentication during recovery. Restrict modifications to UEFI NVRAM variables (BootNext, BootOrder) and implement physical security controls including device locks and tamper-evident protections on high-value systems.

Technical details

The vulnerability stems from inconsistent enforcement of UEFI/BIOS security controls in WinRE's alternate boot path. Attackers can exploit this by manipulating the UEFI BootNext variable (which is not authenticated and takes precedence over BootOrder) during recovery operations, allowing bypass of firmware-level protections. The issue affects systems where Secure Boot validation alone does not prevent unauthorized boot path configuration changes.

Affected products

Microsoft Windows 10
Microsoft Windows 11

Timeline

2026-06-22: disclosed
2026-10-26: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.