CVE-2026-116638
The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including administrator-configured UEFI/BIOS passwords.
Does this matter?
Not yet scored. NVD analysis is pending; check back once CVSS and EPSS values are published.
Description
The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including administrator-configured UEFI/BIOS passwords. An attacker with physical or administrative access to a device may be able to leverage WinRE-related boot mechanisms to circumvent firmware protections and gain unauthorized access to system resources.
- CVSS
- Not yet scored
- EPSS
- No score yet
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Source
- cve@mitre.org
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.