CVE-2025-26678: Windows 10 1809 Auth Bypass Vulnerability

CVE-2025-26678 Overview

CVE-2025-26678 is an improper access control vulnerability in Windows Defender Application Control (WDAC) that allows an unauthorized attacker to bypass a security feature locally. WDAC is a critical Windows security component designed to enforce application whitelisting policies, ensuring only trusted applications can execute on protected systems. This vulnerability undermines the fundamental security guarantees provided by WDAC, potentially allowing malicious or unauthorized code to execute despite restrictive application control policies being in place.

Critical Impact
An attacker with local access can bypass Windows Defender Application Control protections to execute unauthorized applications, potentially leading to complete system compromise with high impact to confidentiality, integrity, and availability.

Affected Products

Microsoft Windows 10 1809 (x64 and x86)
Microsoft Windows 10 21H2
Microsoft Windows 10 22H2
Microsoft Windows 11 22H2
Microsoft Windows 11 23H2
Microsoft Windows 11 24H2
Microsoft Windows Server 2019
Microsoft Windows Server 2022
Microsoft Windows Server 2022 23H2
Microsoft Windows Server 2025

Discovery Timeline

2025-04-08 - CVE-2025-26678 published to NVD
2025-07-09 - Last updated in NVD database

Technical Details for CVE-2025-26678

Vulnerability Analysis

This vulnerability stems from improper access control (CWE-284) within the Windows Defender Application Control subsystem. WDAC policies are designed to create a secure, locked-down environment where only explicitly trusted applications can execute. The vulnerability allows an attacker to circumvent these application control policies without requiring any user interaction or elevated privileges.

The local attack vector means an attacker must have some form of access to the target system, whether through physical access, remote desktop, or by chaining with another vulnerability that provides initial access. Once local access is achieved, the attacker can exploit this flaw to bypass WDAC enforcement, enabling execution of arbitrary code that would otherwise be blocked by the organization's application control policies.

The impact is severe across all three security dimensions: attackers can access sensitive data (confidentiality), modify system files or inject malicious code (integrity), and potentially disrupt system availability. This effectively negates the security value of WDAC deployment in enterprise environments.

Root Cause

The root cause is improper access control within the WDAC policy enforcement mechanism. The vulnerability exists in how WDAC validates and enforces execution restrictions, allowing unauthorized code execution paths that bypass the intended security controls. This represents a fundamental flaw in the access control logic that determines whether an application should be permitted to run under the active WDAC policy.

Attack Vector

The attack requires local access to the target system. An attacker positioned on a system protected by WDAC can exploit this vulnerability to execute applications or scripts that would normally be blocked by the organization's application control policy. This could be achieved by:

An insider threat with legitimate system access
An attacker who has gained initial access through phishing or another vulnerability
Physical access to an unattended workstation

The vulnerability does not require any privileges or user interaction, making it particularly concerning for environments relying on WDAC as a primary defense-in-depth control.

Since no verified code examples are available for this vulnerability, technical exploitation details should be referenced from the Microsoft Security Response Center advisory. The exploitation mechanism involves leveraging the improper access control flaw to bypass WDAC policy enforcement and execute unauthorized binaries.

Detection Methods for CVE-2025-26678

Indicators of Compromise

Unexpected application executions that should be blocked by WDAC policy
Code Integrity event log entries (Event ID 3076/3077) showing policy violations
Anomalous process creation events from normally restricted executables
Unusual binary executions from temporary directories or user-writable locations

Detection Strategies

Monitor Windows Code Integrity logs (Microsoft-Windows-CodeIntegrity/Operational) for policy bypass indicators
Implement endpoint detection rules for execution of binaries not whitelisted in WDAC policies
Deploy SentinelOne Singularity agents to detect anomalous process behavior and execution patterns
Correlate WDAC audit events with process creation telemetry to identify bypass attempts

Monitoring Recommendations

Enable WDAC in audit mode on additional systems to establish baseline and detect exploit attempts
Configure SIEM alerts for Windows Event ID 3076 (audit) and 3077 (enforcement) anomalies
Monitor for unexpected child processes spawned from trusted system binaries
Review endpoint telemetry for unusual execution chains that may indicate WDAC bypass

How to Mitigate CVE-2025-26678

Immediate Actions Required

Apply the April 2025 security updates from Microsoft immediately on all affected Windows systems
Review WDAC policies for proper configuration and enforcement mode
Audit systems for signs of compromise or policy bypass prior to patching
Prioritize patching on systems in high-security environments relying on WDAC

Patch Information

Microsoft has released security updates addressing this vulnerability as part of their security update process. Administrators should obtain the appropriate patches from the Microsoft Security Response Center advisory for CVE-2025-26678. The patches are available through standard Windows Update channels, WSUS, and the Microsoft Update Catalog.

Organizations should follow their change management processes while prioritizing this update given the potential for WDAC bypass in secured environments.

Workarounds

Implement additional endpoint protection with SentinelOne Singularity to provide defense-in-depth against bypass attempts
Enable WDAC audit mode logging to detect potential exploitation attempts before patches are deployed
Restrict local access to critical systems where WDAC is a primary security control
Monitor for unusual process execution patterns using endpoint detection and response (EDR) capabilities

bash

# Enable enhanced WDAC audit logging
# PowerShell command to verify WDAC policy status
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | Select-Object CodeIntegrityPolicyEnforcementStatus, UsermodeCodeIntegrityPolicyEnforcementStatus

# Check Code Integrity event logs for bypass indicators
Get-WinEvent -LogName "Microsoft-Windows-CodeIntegrity/Operational" -MaxEvents 100 | Where-Object {$_.Id -in @(3076, 3077, 3089)}