Description
Improper access control in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally.
Published: 2026-04-14
Score: 4.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Local privilege escalation via improper access control in the Windows VBS enclave
Action: Patch
AI Analysis

Impact

An improper access control bug in Windows Virtualization‑Based Security (VBS) enclaves lets an attacker who already has authorized local access bypass a security feature. The flaw can allow the attacker to elevate privileges or compromise host integrity by exploiting the enclave’s weakened controls.

Affected Systems

Microsoft Windows 11 24H2, 25H2, and 26H1 – including the ARM64 build – and Microsoft Windows Server 2025, which also includes Server Core installations.

Risk and Exploitability

The CVSS score of 4.4 indicates a low‑to‑medium severity assessment. No EPSS value is available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires local, authorized access; no remote attack vector is documented in the supplied information.

Generated by OpenCVE AI on April 14, 2026 at 20:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Microsoft security update for the affected Windows 11 and Windows Server 2025 releases via Windows Update or the Microsoft Security Response Center update guide.
  • Verify that the VBS enclave security feature functions normally after the update.
  • If a patch is not yet available, reduce local user privileges and consider disabling or restricting VBS enclave use through group policy settings.
  • Continue monitoring Microsoft advisories for additional guidance or remediation steps.

Generated by OpenCVE AI on April 14, 2026 at 20:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 17 Apr 2026 19:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:*

Wed, 15 Apr 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows Server 2025 (server Core Installation)
Vendors & Products Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows Server 2025 (server Core Installation)

Wed, 15 Apr 2026 11:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Apr 2026 17:30:00 +0000

Type Values Removed Values Added
Description Improper access control in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally.
Title UEFI Secure Boot Security Feature Bypass Vulnerability
First Time appeared Microsoft
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows Server 2025
Weaknesses CWE-284
CPEs cpe:2.3:o:microsoft:windows_11_24H2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_25H2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_26H1:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows Server 2025
References
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C'}

Subscriptions

Microsoft Windows 11 24h2 Windows 11 24h2 Windows 11 25h2 Windows 11 25h2 Windows 11 26h1 Windows 11 26h1 Windows Server 2025 Windows Server 2025 (server Core Installation)
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-05-12T17:38:36.444Z

Reserved: 2026-03-11T01:49:58.661Z

Link: CVE-2026-32220

cve-icon Vulnrichment

Updated: 2026-04-15T10:42:58.478Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-14T18:17:29.873

Modified: 2026-04-17T19:38:26.777

Link: CVE-2026-32220

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-15T20:45:06Z

Weaknesses