CVE-2026-72980: Windows Hello Auth Bypass Vulnerability

CVE-2026-72980 Overview

CVE-2026-72980 is an uncontrolled search path element vulnerability [CWE-427] in Windows Hello. An authorized local attacker can exploit this weakness to bypass a security feature on the affected system. Microsoft published the advisory through the Microsoft Security Response Center (MSRC).

Exploitation requires local access and high privileges, which limits the practical attack surface. Successful exploitation impacts confidentiality on the target host without affecting integrity or availability. No public exploit code, proof-of-concept, or in-the-wild exploitation has been reported at the time of publication.

Critical Impact
A local, authorized attacker can bypass a Windows Hello security feature and access sensitive information protected by the biometric authentication subsystem.

Affected Products

Microsoft Windows Hello (specific build ranges listed in the Microsoft Security Update Guide)
Windows operating systems that ship Windows Hello biometric authentication components
Refer to the Microsoft Security Update Guide for the authoritative list of affected builds

Discovery Timeline

2026-09-08 - CVE-2026-72980 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-72980

Vulnerability Analysis

CVE-2026-72980 is classified under [CWE-427] Uncontrolled Search Path Element. This weakness class occurs when a program searches for a resource, typically a dynamic-link library (DLL), across a sequence of directories without adequately restricting where the resource may be loaded from. An attacker who can place a malicious file earlier in the search order can cause the target process to load attacker-controlled code or configuration.

In the context of Windows Hello, the flaw enables a local authorized user to influence how a component resolves an external dependency. The result is a bypass of a security feature enforced by the biometric authentication stack. Because the attack requires local access and elevated privileges already held on the machine, exploitation is constrained to scenarios where an attacker has already gained a foothold and seeks to weaken authentication controls or access protected credentials.

Microsoft has not disclosed the specific component filename or search order affected. Full technical details are available in the Microsoft Security Update Guide.

Root Cause

The root cause is improper control of the search path used by a Windows Hello component when locating a required resource. Windows follows a defined DLL and module search order, and when a component does not pin loads to trusted, fully qualified paths, an attacker with sufficient local privileges can plant a resource that resolves ahead of the intended one.

Attack Vector

The attack vector is local and requires an authorized user with high privileges. No user interaction is needed. The attacker stages a controlled file in a directory that appears earlier in the search order used by the affected Windows Hello component. When the component next resolves that dependency, the malicious file is loaded, allowing the security feature to be bypassed. The scope remains unchanged and the impact is limited to confidentiality on the local host.

No verified public exploitation code is available. See the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2026-72980

Indicators of Compromise

Unexpected DLLs or executable files written to directories used by Windows Hello components or adjacent to signed Microsoft binaries.
Non-Microsoft-signed modules loaded into WinBioSvc or related Windows Biometric Framework processes.
New file creation events in user-writable directories that shadow filenames used by system components.
Windows Hello authentication succeeding or being disabled outside of expected administrative activity.

Detection Strategies

Monitor image load events (Sysmon Event ID 7) for Windows Hello and Windows Biometric Framework processes and alert on unsigned or unexpected module paths.
Baseline the module load order for WinBioSvc.exe and related biometric components, then flag deviations.
Correlate file creation events (Sysmon Event ID 11) in directories that precede system paths in the DLL search order with subsequent loads by biometric services.

Monitoring Recommendations

Enable PowerShell and command-line auditing to capture staging activity by local privileged users.
Forward endpoint telemetry to a centralized analytics platform to support cross-host correlation and retrospective hunting.
Track privileged account usage on endpoints that enroll Windows Hello credentials and review anomalous administrative sessions.

How to Mitigate CVE-2026-72980

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide as soon as it is available for your Windows build.
Inventory endpoints that use Windows Hello and prioritize patching for devices holding high-value credentials.
Restrict local administrator rights on end-user endpoints to reduce the population of accounts able to exploit this flaw.
Audit permissions on directories that appear in the DLL search order for biometric and authentication components.

Patch Information

Microsoft has published guidance and updates for CVE-2026-72980 through the Microsoft Security Update Guide. Consult the advisory for build-specific KB numbers, superseded updates, and installation prerequisites. Apply updates through Windows Update, WSUS, Microsoft Intune, or your standard patch management workflow.

Workarounds

No vendor-supplied workaround has been published; patching is the recommended path.
Enforce least privilege so that standard users cannot obtain the high privileges required for exploitation.
Apply application control policies such as Windows Defender Application Control (WDAC) or AppLocker to block loading of unsigned modules from user-writable directories.
Restrict write access to directories in the search path of Windows Hello components using NTFS access control lists.

bash

# Example: enumerate Windows Hello related services and their binary paths for review
Get-Service -Name WbioSrvc | Select-Object Name, Status, StartType
Get-CimInstance Win32_Service -Filter "Name='WbioSrvc'" | Select-Object Name, PathName, StartName