CVE-2026-57097: Windows 10 1607 Auth Bypass Vulnerability

CVE-2026-57097 Overview

CVE-2026-57097 is a security feature bypass vulnerability in Microsoft XML affecting a broad range of Windows client and server operating systems. The flaw stems from an untrusted search path condition [CWE-426] that an unauthorized attacker can exploit through a physical attack vector to bypass a security feature. Successful exploitation impacts confidentiality, integrity, and availability of the affected host.

Microsoft rates the issue as MEDIUM severity with a CVSS 3.1 base score of 6.8. The vulnerability affects Windows 10, Windows 11, and Windows Server versions from 2012 through 2025.

Critical Impact
An attacker with physical access to a vulnerable Windows system can leverage an untrusted DLL or resource search path in Microsoft XML to bypass a security feature and gain high impact to confidentiality, integrity, and availability.

Affected Products

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2) across x86, x64, and arm64 architectures
Microsoft Windows 11 (versions 24H2, 25H2, 26H1) on x64 and arm64
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-07-14 - CVE-2026-57097 published to the National Vulnerability Database
2026-07-20 - Last updated in the NVD database

Technical Details for CVE-2026-57097

Vulnerability Analysis

CVE-2026-57097 is classified under [CWE-426] Untrusted Search Path. The issue resides within Microsoft XML components shipped with supported Windows operating systems. When the affected component loads a dependent library or resource, it consults a search path that includes locations an attacker can influence when they have physical access to the machine.

Because the search order is not adequately constrained, an attacker can place a malicious file in a directory that is resolved before the trusted system location. When Microsoft XML subsequently loads that file, the untrusted content is used in place of the legitimate module. The outcome is a bypass of an intended security feature, giving the attacker elevated influence over subsequent code paths.

Root Cause

The root cause is improper control of the search path used by Microsoft XML when locating dependent modules or configuration data. Windows resolves such lookups against a sequence of directories, and if a writable or removable-media location precedes the trusted system directory, an attacker-supplied file can be loaded instead of the genuine one.

Attack Vector

Exploitation requires a physical attack (AV:P) with low complexity, no privileges, and no user interaction. A typical scenario involves an attacker with hands-on access to a locked or partially locked device, connecting removable media or manipulating local storage so that a malicious file sits in a search path location consulted by Microsoft XML. When the component next executes, the untrusted resource is loaded, bypassing the intended security control.

No public proof-of-concept is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is 0.248%.

Detection Methods for CVE-2026-57097

Indicators of Compromise

Unexpected DLL, XML, or manifest files placed in directories that precede system paths in the process search order, especially on shared or kiosk endpoints
Microsoft XML related processes loading modules from removable drives, user-writable directories, or non-standard paths under %TEMP% or %USERPROFILE%
Recent physical access events such as USB device insertions, external boot attempts, or console logons on endpoints that store sensitive data

Detection Strategies

Monitor Microsoft-Windows-Sysmon Event ID 7 (Image Loaded) for Microsoft XML consumers loading modules from unusual paths outside C:\Windows\System32
Correlate USB and removable media events (Event IDs 6416, 4663) with subsequent process launches that interact with XML parsing components
Alert on file creation events writing DLL, XSL, or configuration files into directories adjacent to trusted Microsoft XML binaries

Monitoring Recommendations

Baseline expected module load paths for XML parsing components across the fleet and flag deviations
Enable tamper-evident logging on kiosks, shared workstations, and unattended servers where physical access risk is elevated
Ingest endpoint telemetry into a centralized data lake to hunt for search-path hijack patterns across the environment

How to Mitigate CVE-2026-57097

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-57097 Advisory to every affected Windows 10, Windows 11, and Windows Server build
Prioritize patching on endpoints with physical exposure such as kiosks, point-of-sale systems, laptops used in transit, and unattended servers
Verify BitLocker or equivalent full-disk encryption is enabled to reduce the value of physical access

Patch Information

Microsoft has published an advisory and update guidance for this vulnerability. Administrators should consult the Microsoft CVE-2026-57097 Advisory for the specific KB numbers that apply to each Windows version and architecture, then deploy through Windows Update, WSUS, Microsoft Intune, or Configuration Manager.

Workarounds

Restrict physical access to endpoints and enforce chassis locks, port control, and secure boot on high-value systems
Disable booting from removable media in firmware and enforce USB device control policies through group policy or endpoint management tooling
Restrict write permissions on directories that appear in the DLL and resource search path for Microsoft XML consumers
Enforce application control policies such as Windows Defender Application Control or AppLocker to block execution of unsigned modules from user-writable locations

bash

# Example: enumerate installed KBs to confirm the CVE-2026-57097 patch is applied
wmic qfe list brief /format:table

# Example: enforce USB storage restriction via registry (requires reboot)
reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v Start /t REG_DWORD /d 4 /f