CVE-2026-45658: Windows 10 1607 Auth Bypass Vulnerability

CVE-2026-45658 Overview

CVE-2026-45658 is a protection mechanism failure in Windows BitLocker that allows an unauthorized attacker with physical access to bypass the drive encryption security feature. The flaw is classified under [CWE-284] Improper Access Control and affects every supported branch of Windows 10, Windows 11, and Windows Server. An attacker who successfully exploits the weakness can access data on a BitLocker-protected volume despite the device being encrypted. Microsoft published the advisory through the Microsoft Security Response Center on 2026-06-09.

Critical Impact

An attacker with physical possession of a device can defeat BitLocker full-disk encryption and read, modify, or destroy data on the protected volume.

Affected Products

• Microsoft Windows 10 (1607, 1809, 21H2, 22H2) on x86, x64, and ARM64
• Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) on x64 and ARM64
• Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

• 2026-06-09 - CVE-2026-45658 published to the National Vulnerability Database
• 2026-06-09 - Microsoft releases security update via the Microsoft Security Update Guide
• 2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-45658

Vulnerability Analysis

The vulnerability is a Secure Boot or pre-boot environment protection mechanism failure that breaks the trust assumptions BitLocker relies on. BitLocker derives its volume master key from measurements taken during boot, including TPM PCR values that attest to firmware and bootloader state. When the protection mechanism fails, an attacker can manipulate the boot path or recovery flow so that the operating system unseals the encryption key without the legitimate authentication factor. The flaw requires no privileges and no user interaction once physical access is obtained.

Root Cause

Microsoft attributes the issue to a protection mechanism failure within the BitLocker code path. The control responsible for validating the integrity of the unlock workflow does not correctly enforce its security check, mapping to [CWE-284] Improper Access Control. This allows pre-boot components or recovery flows to release key material outside the intended trust boundary.

Attack Vector

Exploitation requires direct physical access to the target device. Typical scenarios include lost or stolen laptops, evil maid attacks against unattended hardware, and supply chain interception. The attacker boots the device through an alternate path, such as the Windows Recovery Environment, an attached debug interface, or modified boot media, and triggers the failing check. Successful exploitation grants full read and write access to the encrypted volume, exposing credentials, certificates, and business data stored at rest.

No public proof-of-concept code has been published, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog at the time of writing.

Detection Methods for CVE-2026-45658

Indicators of Compromise

• Unexpected entries in the BitLocker event log (Microsoft-Windows-BitLocker-API/Management) showing recovery key usage or protector changes without an approved change ticket.
• Boot configuration data (bcdedit) modifications, new boot entries, or unsigned bootloaders appearing on managed endpoints.
• TPM PCR validation failures or repeated entries into the Windows Recovery Environment on devices reported as lost, stolen, or returned from repair.

Detection Strategies

• Correlate physical asset events (laptop returned, RMA, travel) with BitLocker protector changes and Windows Recovery Environment launches in endpoint telemetry.
• Hunt for first-boot anomalies after extended offline periods, including changes to MeasuredBoot logs and unexpected winload.efi or bootmgr hash values.
• Use the Singularity Platform to baseline boot integrity events and surface deviations through Storyline-linked alerts, and use Purple AI to pivot from a single suspicious boot event to related identity and file access activity.

Monitoring Recommendations

• Forward BitLocker, TPM, and Secure Boot event channels to Singularity Data Lake for retention and correlation against identity and endpoint signals.
• Alert on any use of the BitLocker recovery password outside of help-desk-approved workflows.
• Track devices that fail attestation in Microsoft Intune or equivalent MDM and quarantine them until reimaged.

How to Mitigate CVE-2026-45658

Immediate Actions Required

• Deploy the June 2026 Microsoft security updates referenced in the Microsoft Security Update Guide to all affected Windows client and server builds.
• Rotate BitLocker recovery keys after patching, especially on devices that have left the physical custody of the organization.
• Enable pre-boot authentication using a TPM plus PIN or TPM plus startup key for high-value endpoints.

Patch Information

Microsoft has released cumulative security updates that remediate the BitLocker protection mechanism failure across all supported Windows 10, Windows 11, and Windows Server versions listed in the advisory. Administrators should validate that the latest cumulative update is installed and that Secure Boot, TPM 2.0, and Device Encryption are enforced through Group Policy or Intune compliance baselines.

Workarounds

• Require TPM plus PIN pre-boot authentication on all BitLocker-protected devices to block unattended unlock attempts.
• Disable boot from external media in firmware and set a BIOS or UEFI administrator password to prevent boot order tampering.
• Restrict access to the Windows Recovery Environment by enforcing BitLocker recovery key prompts and disabling unattended reagentc reset paths.
• Enroll laptops in remote-wipe-capable MDM and report lost devices immediately so encryption keys can be revoked.

# Configuration example: enforce TPM+PIN pre-boot authentication via Group Policy registry keys
reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseAdvancedStartup /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPM /t REG_DWORD /d 2 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMPIN /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKey /t REG_DWORD /d 2 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKeyPIN /t REG_DWORD /d 2 /f

# Verify BitLocker protector status after applying the patch
manage-bde -status C:
manage-bde -protectors -get C: