What’s Vulnerable › Vulnerabilities

CVE-2021-1638: Windows Bluetooth Security Feature Bypass Vulnerability

• Severity: low (CVSS 2.1 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-01-12 · updated 2026-06-17

Description

Microsoft is aware of the "Impersonation in the Passkey Entry Protocol" vulnerability. For more information regarding the vulnerability, please see this statement from the Bluetooth SIG. To address the vulnerability, Microsoft has released a software update that will fail attempts to pair if the remote device exchanges a public key with the same X coordinate as the locally exchanged public key

Affected products

• Microsoft Windows 10 Version 1607: 20h2, 1803, 1809, 1909, 2004
• Microsoft Windows Server 2016: 20h2, 1909, 2004
• Microsoft Windows Server 2019: all versions
• Microsoft Windows 10 1803: from 10.0.0 before publication — fixed in publication
• Microsoft Windows 10: from 10.0.0 before publication — fixed in publication
• Microsoft Windows 10 1909: from 10.0.0 before publication — fixed in publication
• Microsoft Windows 10 2004: from 10.0.0 before publication — fixed in publication
• Microsoft Windows 10 20H2: from 10.0.0 before publication — fixed in publication
• Microsoft Windows Server 2019: from 10.0.0 before publication — fixed in publication
• Microsoft Windows Server, version 1909 (Server Core installation): from 10.0.0 before publication — fixed in publication
• Microsoft Windows Server version 2004: from 10.0.0 before publication — fixed in publication
• Microsoft Windows Server version 20H2: from 10.0.0 before publication — fixed in publication

How to fix

Upgrade to a fixed version: Microsoft Windows 10 1803 publication; Microsoft Windows 10 publication; Microsoft Windows 10 1909 publication; Microsoft Windows 10 2004 publication; Microsoft Windows 10 20H2 publication; Microsoft Windows Server 2019 publication; Microsoft Windows Server, version 1909 (Server Core installation) publication; Microsoft Windows Server version 2004 publication; Microsoft Windows Server version 20H2 publication. Check the vendor advisory for mitigations.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1638
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1638

Get alerted when CVE-2021-1638 or the next vulnerability affects your stack