CVE-2026-61928 Overview
CVE-2026-61928 is a medium-severity information disclosure vulnerability in Microsoft Windows Hello. The flaw is rooted in cleartext storage of sensitive information [CWE-312], allowing an authorized local attacker to tamper with data stored by the biometric authentication subsystem. Successful exploitation impacts the integrity of Windows Hello data on the affected host without requiring user interaction.
Microsoft published the advisory on 2026-08-11, and Windows 10, Windows 11, and Windows Server platforms across multiple release channels are impacted. The vulnerability requires local access and low privileges, limiting remote exploitation scenarios.
Critical Impact
An authorized local attacker can tamper with cleartext Windows Hello data, undermining the integrity of biometric authentication material on affected systems.
Affected Products
- Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H1)
- Microsoft Windows Server 2016, 2019, 2022, and 2025
Discovery Timeline
- 2026-08-11 - CVE-2026-61928 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-61928
Vulnerability Analysis
The vulnerability resides within Windows Hello, Microsoft's biometric and PIN-based authentication framework. Windows Hello stores sensitive authentication-related information in cleartext on the local system. Because the data is not encrypted at rest, an authorized user on the host can locate and modify these artifacts.
The issue is classified under CWE-312 (Cleartext Storage of Sensitive Information). The primary security consequence is loss of integrity. Confidentiality and availability are not directly impacted by this specific flaw, but tampering with authentication state can enable follow-on attacks against identity trust boundaries.
Root Cause
The root cause is the absence of encryption or integrity protection on sensitive Windows Hello data written to local storage. Any process running with the authenticated user's privileges can read and alter these values. Cleartext storage of authentication material violates baseline secure-storage expectations for credential subsystems.
Attack Vector
Exploitation requires local access to the target system with valid low-privilege credentials. No user interaction is required beyond the attacker's own session. An attacker with a local foothold, whether via legitimate credentials, session hijack, or a prior compromise, can locate the cleartext data and modify it to influence Windows Hello behavior. Remote or network-based exploitation is not applicable given the local attack vector. No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
See the Microsoft Security Update CVE-2026-61928 advisory for vendor-specific technical details.
Detection Methods for CVE-2026-61928
Indicators of Compromise
- Unexpected modification timestamps on Windows Hello data files and container directories under user profile paths
- Non-Windows-Hello processes performing write operations against biometric or PIN credential storage locations
- Anomalous access to NgcCtnr, NgcCtnrSvc, or Ngc container files by user-mode processes
Detection Strategies
- Monitor file integrity on Windows Hello storage locations and alert on writes by processes other than the Ngc service
- Correlate local logon events with subsequent writes to biometric credential storage to identify tampering attempts
- Baseline normal Windows Hello enrollment and update behavior, then flag deviations tied to non-interactive sessions
Monitoring Recommendations
- Enable Windows object access auditing for Windows Hello containers and forward events to a centralized log platform
- Review Microsoft-Windows-HelloForBusiness and Microsoft-Windows-NgcCtnrSvc operational logs for unexpected modifications
- Track privilege usage on hosts where biometric authentication is deployed for high-value users
How to Mitigate CVE-2026-61928
Immediate Actions Required
- Apply the Microsoft security update for CVE-2026-61928 across all affected Windows client and server SKUs as soon as testing permits
- Prioritize patching on hosts used by privileged users, administrators, and identity-sensitive workloads
- Audit local accounts on affected systems and remove unnecessary standing local logon rights
Patch Information
Microsoft has released fixes referenced in the Microsoft Security Update CVE-2026-61928 advisory. Consult the Microsoft Update Guide for the specific KB article and build numbers that apply to each Windows version listed in the affected products section, and deploy through Windows Update, WSUS, Intune, or Configuration Manager per your standard patch process.
Workarounds
- Restrict local interactive and Remote Desktop logon rights to reduce the pool of users who can exploit the local attack vector
- Enforce BitLocker full-disk encryption to raise the cost of offline access to Windows Hello storage on lost or stolen devices
- Where feasible, pair Windows Hello with additional multi-factor controls so that tampering with local biometric state alone does not grant access to sensitive resources
# Verify installed KB for the applicable Windows build after patching
wmic qfe list brief /format:table
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
