{"id":"CVE-2026-116638","kind":"vulnerability","aliases":["CVE-2026-116638"],"related":[],"title":"Windows: WinRE flaw lets attackers bypass UEFI/BIOS password protections","description":"The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including administrator-configured UEFI/BIOS passwords. An attacker with physical or administrative access to a device may be able to leverage WinRE-related boot mechanisms to circumvent firmware protections and gain unauthorized access to system resources.","summary":"The Windows Recovery Environment in Windows 10 and 11 can be abused to get around firmware protections, including administrator-set UEFI/BIOS passwords. An attacker with physical or administrative access to a device may use WinRE boot mechanisms to reach system resources they should not.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoints","firmware","infrastructure","windows"],"not_affected_if":["no-uefi-password"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-26T19:16:31+00:00","first_seen_at":"2026-10-26T19:32:06+00:00","triaged_at":"2026-10-26T19:34:01+00:00","updated_at":"2026-10-26T19:34:01+00:00","category":"infrastructure","confidence":0.35,"triage":{"at":"2026-10-26T19:34:01Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Windows: WinRE flaw lets attackers bypass UEFI/BIOS password protections","impact":"medium","summary":"The Windows Recovery Environment in Windows 10 and 11 can be abused to get around firmware protections, including administrator-set UEFI/BIOS passwords. An attacker with physical or administrative access to a device may use WinRE boot mechanisms to reach system resources they should not.","category":"infrastructure","nicknames":[],"who_cares":["windows","endpoints","firmware"],"confidence":0.35,"needs_auth":"unknown","worst_case":"Attacker bypasses firmware password and reaches protected system resources","analyst_note":"Check the Microsoft MSRC advisory for CVE-2026-116638 for affected builds, patch KB numbers and exploitation prerequisites; the NVD entry gave no severity or details.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-uefi-password"],"who_is_affected":"Devices running Windows 10 or Windows 11 where an administrator has set a UEFI/BIOS password to protect firmware settings. The sources do not say which builds are affected or whether a default configuration is exposed. Teams without managed Windows endpoints with firmware passwords can likely skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000583,"input_tokens":3341,"output_tokens":498,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-116638':12A,15A '-2026':11A,14A '10':26B,69C '11':28B,71C 'abl':99C 'abus':31B 'access':49B,93C,114C 'administr':39B,48B,83C,92C 'administrator-configur':82C 'administrator-set':38B 'allow':73C 'around':34B 'attack':5A,44B,75C,88C 'boot':56B,105C 'bypass':6A,77C 'circumv':108C 'configur':84C 'control':80C 'cve':10A,13A 'devic':52B,96C 'endpoint':16B 'environ':23B,65C 'firmwar':17B,35B,78C,109C 'flaw':3A 'gain':112C 'get':33B 'includ':37B,81C 'infrastructur':18B 'let':4A 'leverag':101C 'may':53B,72C,97C 'mechan':57B,106C 'password':8A,42B,86C 'physic':46B,90C 'protect':9A,36B,110C 'reach':59B 'recoveri':22B,64C 'relat':104C 'resourc':61B,117C 'secur':79C 'set':40B 'system':60B,116C 'uefi/bios':7A,41B,85C 'unauthor':113C 'use':54B 'window':1A,19B,21B,25B,63C,68C 'winr':2A,55B,66C,103C 'winre-rel':102C","nicknames":[],"mitigations":[],"who_affected":"Devices running Windows 10 or Windows 11 where an administrator has set a UEFI/BIOS password to protect firmware settings. The sources do not say which builds are affected or whether a default configuration is exposed. Teams without managed Windows endpoints with firmware passwords can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T19:16:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116638","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116638","severity":null,"published_at":"2026-10-26T19:16:31+00:00","modified_at":"2026-10-26T19:16:31+00:00","first_seen_at":"2026-10-26T19:32:06+00:00","fetched_at":"2026-10-26T19:32:06+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}