CVE-2026-47656: Windows 10 1607 Auth Bypass Vulnerability

CVE-2026-47656 Overview

CVE-2026-47656 is a protection mechanism failure [CWE-693] in Windows Boot Manager. An authorized local attacker can bypass a security feature on affected Windows client and server systems. The vulnerability affects a broad range of Microsoft operating systems, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Windows Server 2025.

Microsoft published the advisory on June 9, 2026, and the issue carries a CVSS 3.1 base score of 7.9. The scope-changed nature of the flaw means a successful bypass can affect components beyond the initially compromised security boundary, including pre-boot integrity controls.

Critical Impact
An authorized attacker with high privileges on a local system can bypass a Windows Boot Manager security feature, undermining boot-time protections and enabling persistence or tampering across a wide range of supported Windows versions.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) across x86, x64, and ARM64 architectures
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) across x64 and ARM64 architectures
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-06-09 - CVE-2026-47656 published to NVD with Microsoft advisory release
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47656

Vulnerability Analysis

The vulnerability resides in Windows Boot Manager, the firmware-stage component responsible for loading the Windows kernel and enforcing boot-time integrity. Microsoft classifies the flaw as a protection mechanism failure under [CWE-693], indicating that a security control intended to enforce a policy can be circumvented under attacker-controlled conditions.

The scope-changed impact means a successful bypass affects resources beyond the immediate vulnerable component. In practice, this points to subversion of Secure Boot or related boot integrity protections that downstream Windows components rely on for trust decisions.

The attack requires high privileges and local access, which limits opportunistic exploitation. However, attackers who already hold administrative footholds frequently target boot-stage protections to install bootkits, disable code integrity, or persist across reinstallations.

Root Cause

The root cause is improper enforcement of a security check inside Windows Boot Manager. Microsoft has not published low-level technical details, but [CWE-693] classifications typically reflect missing validation, an incomplete trust boundary, or a logic path that allows a protected operation to proceed without satisfying its security precondition.

Attack Vector

Exploitation requires local access and elevated privileges on the target host. The attacker invokes the affected Boot Manager code path to bypass the protected security feature, persisting changes that take effect at the next boot. No user interaction is required.

No public proof-of-concept code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of publication. See the Microsoft Security Update CVE-2026-47656 advisory for vendor-supplied details.

Detection Methods for CVE-2026-47656

Indicators of Compromise

Unexpected modifications to the EFI System Partition, including changes to bootmgfw.efi, bootmgr.efi, or files under \EFI\Microsoft\Boot\
Changes to Boot Configuration Data (BCD) such as nointegritychecks, testsigning, or modified {bootmgr} entries
Unsigned or unexpected drivers loaded early in the boot sequence after privileged user activity
TPM PCR measurements that diverge from baseline values established for known-good boot states

Detection Strategies

Monitor for bcdedit.exe invocations that alter integrity, signature, or boot policy settings, particularly from interactive administrator sessions
Track writes to the EFI System Partition and compare hashes of boot binaries against the patched vendor baseline
Correlate privileged process execution with subsequent reboots and boot configuration changes to surface tampering chains
Use Measured Boot and remote attestation against TPM event logs to identify deviations after suspected privileged activity

Monitoring Recommendations

Enable Windows Defender Credential Guard and Hypervisor-Protected Code Integrity (HVCI) telemetry to surface attempts to weaken boot-time enforcement
Forward Security and System event logs covering boot configuration changes and driver loads to a centralized analytics platform
Audit local administrator and SYSTEM-context process activity that touches \Device\HarddiskVolume*\EFI\ paths

How to Mitigate CVE-2026-47656

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-47656 to all affected Windows client and server builds
Inventory endpoints and servers running the affected Windows 10, Windows 11, and Windows Server versions and prioritize patching of domain controllers and privileged workstations
Restrict and audit local administrator membership to reduce the population of accounts able to invoke the vulnerable code path
Validate Secure Boot, BitLocker, and TPM attestation status on critical hosts after patch deployment

Patch Information

Microsoft has released security updates for all affected operating systems through the standard Windows Update channels. Refer to the Microsoft Security Update CVE-2026-47656 page for build-specific KB numbers and deployment guidance. Apply updates on the first available maintenance window because the flaw weakens boot-time security guarantees that other defenses depend on.

Workarounds

No vendor-supplied workaround replaces the patch; apply the Microsoft update as the primary remediation
Enforce least privilege so that non-administrative users cannot reach the vulnerable Boot Manager code path
Require BitLocker with TPM and PIN on sensitive endpoints to raise the cost of offline tampering with boot components
Use remote attestation to detect drifted boot measurements on hosts pending patch deployment

bash

# Verify Secure Boot and boot integrity posture on a Windows host
Confirm-SecureBootUEFI
bcdedit /enum {bootmgr}
bcdedit /enum {current} | findstr /i "integrity testsigning nointegritychecks"
Get-Tpm