CVE-2025-26678: Windows 10 1809 Auth Bypass Vulnerability

CVE-2025-26678 Overview

CVE-2025-26678 is an improper access control vulnerability in Windows Defender Application Control (WDAC) that allows an unauthorized attacker to bypass a security feature locally. WDAC is a critical Windows security component designed to enforce application whitelisting policies, ensuring only trusted applications can execute on protected systems. This vulnerability undermines the fundamental security guarantees provided by WDAC, potentially allowing malicious or unauthorized code to execute despite restrictive application control policies being in place.

Critical Impact

An attacker with local access can bypass Windows Defender Application Control protections to execute unauthorized applications, potentially leading to complete system compromise with high impact to confidentiality, integrity, and availability.

Affected Products

• Microsoft Windows 10 1809 (x64 and x86)
• Microsoft Windows 10 21H2
• Microsoft Windows 10 22H2
• Microsoft Windows 11 22H2
• Microsoft Windows 11 23H2
• Microsoft Windows 11 24H2
• Microsoft Windows Server 2019
• Microsoft Windows Server 2022
• Microsoft Windows Server 2022 23H2
• Microsoft Windows Server 2025

Discovery Timeline

• 2025-04-08 - CVE-2025-26678 published to NVD
• 2025-07-09 - Last updated in NVD database

Technical Details for CVE-2025-26678

Vulnerability Analysis

This vulnerability stems from improper access control (CWE-284) within the Windows Defender Application Control subsystem. WDAC policies are designed to create a secure, locked-down environment where only explicitly trusted applications can execute. The vulnerability allows an attacker to circumvent these application control policies without requiring any user interaction or elevated privileges.

The local attack vector means an attacker must have some form of access to the target system, whether through physical access, remote desktop, or by chaining with another vulnerability that provides initial access. Once local access is achieved, the attacker can exploit this flaw to bypass WDAC enforcement, enabling execution of arbitrary code that would otherwise be blocked by the organization's application control policies.

The impact is severe across all three security dimensions: attackers can access sensitive data (confidentiality), modify system files or inject malicious code (integrity), and potentially disrupt system availability. This effectively negates the security value of WDAC deployment in enterprise environments.

Root Cause

The root cause is improper access control within the WDAC policy enforcement mechanism. The vulnerability exists in how WDAC validates and enforces execution restrictions, allowing unauthorized code execution paths that bypass the intended security controls. This represents a fundamental flaw in the access control logic that determines whether an application should be permitted to run under the active WDAC policy.

Attack Vector

The attack requires local access to the target system. An attacker positioned on a system protected by WDAC can exploit this vulnerability to execute applications or scripts that would normally be blocked by the organization's application control policy. This could be achieved by:

1. An insider threat with legitimate system access
2. An attacker who has gained initial access through phishing or another vulnerability
3. Physical access to an unattended workstation

The vulnerability does not require any privileges or user interaction, making it particularly concerning for environments relying on WDAC as a primary defense-in-depth control.

Since no verified code examples are available for this vulnerability, technical exploitation details should be referenced from the Microsoft Security Response Center advisory. The exploitation mechanism involves leveraging the improper access control flaw to bypass WDAC policy enforcement and execute unauthorized binaries.

Detection Methods for CVE-2025-26678

Indicators of Compromise

• Unexpected application executions that should be blocked by WDAC policy
• Code Integrity event log entries (Event ID 3076/3077) showing policy violations
• Anomalous process creation events from normally restricted executables
• Unusual binary executions from temporary directories or user-writable locations

Detection Strategies

• Monitor Windows Code Integrity logs (Microsoft-Windows-CodeIntegrity/Operational) for policy bypass indicators
• Implement endpoint detection rules for execution of binaries not whitelisted in WDAC policies
• Deploy SentinelOne Singularity agents to detect anomalous process behavior and execution patterns
• Correlate WDAC audit events with process creation telemetry to identify bypass attempts

Monitoring Recommendations

• Enable WDAC in audit mode on additional systems to establish baseline and detect exploit attempts
• Configure SIEM alerts for Windows Event ID 3076 (audit) and 3077 (enforcement) anomalies
• Monitor for unexpected child processes spawned from trusted system binaries
• Review endpoint telemetry for unusual execution chains that may indicate WDAC bypass

How to Mitigate CVE-2025-26678

Immediate Actions Required

• Apply the April 2025 security updates from Microsoft immediately on all affected Windows systems
• Review WDAC policies for proper configuration and enforcement mode
• Audit systems for signs of compromise or policy bypass prior to patching
• Prioritize patching on systems in high-security environments relying on WDAC

Patch Information

Microsoft has released security updates addressing this vulnerability as part of their security update process. Administrators should obtain the appropriate patches from the Microsoft Security Response Center advisory for CVE-2025-26678. The patches are available through standard Windows Update channels, WSUS, and the Microsoft Update Catalog.

Organizations should follow their change management processes while prioritizing this update given the potential for WDAC bypass in secured environments.

Workarounds

• Implement additional endpoint protection with SentinelOne Singularity to provide defense-in-depth against bypass attempts
• Enable WDAC audit mode logging to detect potential exploitation attempts before patches are deployed
• Restrict local access to critical systems where WDAC is a primary security control
• Monitor for unusual process execution patterns using endpoint detection and response (EDR) capabilities

# Enable enhanced WDAC audit logging
# PowerShell command to verify WDAC policy status
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | Select-Object CodeIntegrityPolicyEnforcementStatus, UsermodeCodeIntegrityPolicyEnforcementStatus

# Check Code Integrity event logs for bypass indicators
Get-WinEvent -LogName "Microsoft-Windows-CodeIntegrity/Operational" -MaxEvents 100 | Where-Object {$_.Id -in @(3076, 3077, 3089)}