CVE-2026-45656: Windows 10 1607 Auth Bypass Vulnerability

CVE-2026-45656 Overview

CVE-2026-45656 is a protection mechanism failure in Windows Unified Extensible Firmware Interface (UEFI) that allows an authorized local attacker to bypass a security feature. The flaw affects every supported Windows client and Windows Server release, spanning Windows 10 1607 through Windows 11 26H1, as well as Windows Server 2012 through Windows Server 2025. The weakness is tracked under [CWE-693] (Protection Mechanism Failure) and requires local access with low privileges to exploit. Microsoft published the advisory on June 9, 2026, and the issue carries a high impact rating across confidentiality, integrity, and availability.

Critical Impact
An authenticated local attacker can bypass UEFI-enforced security controls, undermining boot-time integrity guarantees on affected Windows systems.

Affected Products

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H1)
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-06-09 - CVE-2026-45656 published to the National Vulnerability Database
2026-06-09 - Microsoft releases security update guidance
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-45656

Vulnerability Analysis

The vulnerability resides in the Windows UEFI subsystem, which enforces firmware-level security features such as Secure Boot, boot integrity validation, and pre-OS code signing checks. A protection mechanism failure allows an authorized local user to circumvent one of these controls. Because UEFI executes before the operating system, weaknesses at this layer can erode the trust anchors that downstream Windows security features depend on.

The issue affects the full matrix of supported Windows releases, indicating the flawed logic resides in shared UEFI handling code rather than a version-specific component. Successful exploitation yields high impact on confidentiality, integrity, and availability, consistent with bypassing a boot-time security boundary.

Root Cause

The root cause is classified as [CWE-693], Protection Mechanism Failure. The affected UEFI code path does not adequately enforce the security feature it is designed to protect, allowing an authorized caller to evade the intended control. Microsoft has not published technical specifics beyond the advisory, and no public proof-of-concept is available.

Attack Vector

Exploitation requires local access and low-privileged authentication on the target system. No user interaction is required, and the attack does not traverse the network. An attacker who has already obtained an interactive session or code execution on the host can invoke the vulnerable UEFI interaction path to bypass the security feature, potentially enabling persistence below the OS or weakening other platform protections.

No verified exploit code is publicly available. See the Microsoft Security Update Guide for CVE-2026-45656 for vendor technical details.

Detection Methods for CVE-2026-45656

Indicators of Compromise

Unexpected modifications to UEFI variables, Secure Boot policy entries, or boot configuration data on affected hosts.
Unsigned or unexpected drivers loading early in the boot sequence after a successful local authentication event.
Discrepancies between measured boot logs (TPM PCR values) and the expected baseline for the platform.

Detection Strategies

Monitor Windows event logs for anomalous local privilege use, driver installation, and changes to boot-related services on systems missing the June 2026 cumulative update.
Use platform attestation and measured boot data to identify hosts whose boot integrity state diverges from a known-good baseline.
Correlate local logon activity with subsequent firmware variable writes or bcdedit modifications to identify suspicious sequences.

Monitoring Recommendations

Track patch deployment status for the June 2026 Windows security updates across all client and server SKUs in scope.
Alert on creation or modification of EFI system partition contents and changes to Secure Boot keys (PK, KEK, db, dbx).
Centralize boot integrity telemetry to identify clusters of hosts exhibiting the same boot-time anomalies.

How to Mitigate CVE-2026-45656

Immediate Actions Required

Apply the Microsoft security update referenced in the advisory to all affected Windows client and Windows Server systems.
Prioritize patching of systems where untrusted users can obtain local sessions, including shared workstations, jump hosts, and multi-tenant servers.
Restrict local logon rights and review membership of privileged local groups to reduce the population of users able to exploit the flaw.

Patch Information

Microsoft has published the official fix and guidance at the Microsoft Security Update Guide for CVE-2026-45656. Administrators should consult that page for KB article numbers, update channels, and any prerequisite servicing stack updates required for each affected Windows version.

Workarounds

No vendor-supplied workaround replaces the security update; prompt patch deployment is the authoritative remediation.
Where patching is delayed, enforce least privilege and require multi-factor authentication for interactive logons to limit the pool of authorized attackers.
Enable and validate Secure Boot, BitLocker, and TPM-backed measured boot to make post-exploitation tampering more detectable.

bash

# Verify patch and boot integrity state on a Windows host
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
Confirm-SecureBootUEFI
Get-Tpm