What’s Vulnerable › Vulnerabilities

CVE-2026-116638

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-26 · updated 2026-10-30
• Weakness: CWE-288

Description

The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including administrator-configured UEFI/BIOS passwords. An attacker with physical or administrative access to a device may be able to leverage WinRE-related boot mechanisms to circumvent firmware protections and gain unauthorized access to system resources.

References

• https://beafn28.es/articulos/winre-uefi-bypass
• https://kb.cert.org/vuls/id/226679
• https://www.kb.cert.org/vuls/id/226679
• https://beafn28.es/articulos/winre-uefi-bypass

Get alerted when CVE-2026-116638 or the next vulnerability affects your stack