CVE WatchOct 26, 2026

CVE-2026-116638

The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including administ

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Oct 26, 2026 · Last modified: Oct 26, 2026

EPSS · 30d

Not enough EPSS history yet.

Technical description

The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including administrator-configured UEFI/BIOS passwords. An attacker with physical or administrative access to a device may be able to leverage WinRE-related boot mechanisms to circumvent firmware protections and gain unauthorized access to system resources.

Official references

beafn28.eshttps://beafn28.es/articulos/winre-uefi-bypass
kb.cert.orghttps://kb.cert.org/vuls/id/226679

Related CVEs

No related CVEs by CWE or product.