CVE-2026-73008 Overview
CVE-2026-73008 is an information disclosure vulnerability in the Windows Biometric Service. The flaw allows an authenticated local attacker to read private personal information that the service exposes to unauthorized actors. The issue is tracked under CWE-359: Exposure of Private Personal Information to an Unauthorized Actor and affects supported versions of Windows 10, Windows 11, and Windows Server. Exploitation requires local access and low-level privileges, but no user interaction. Microsoft addressed the flaw through its Update Guide advisory.
Critical Impact
An authorized local attacker can disclose sensitive biometric-related information handled by the Windows Biometric Service, potentially exposing data tied to user identity and authentication.
Affected Products
- Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H1)
- Microsoft Windows Server 2016, 2019, 2022, and 2025
Discovery Timeline
- 2026-09-08 - CVE-2026-73008 published to the National Vulnerability Database
- 2026-09-10 - Last updated in NVD database
Technical Details for CVE-2026-73008
Vulnerability Analysis
The Windows Biometric Service (wbiosrvc) brokers access to biometric devices such as fingerprint readers and facial recognition cameras used by Windows Hello. It stores and processes template data, enrollment metadata, and user-linked identifiers. CVE-2026-73008 arises because the service exposes private personal information to callers that should not be authorized to receive it. A local user with standard privileges can query or interact with the service in a way that returns data intended to remain confidential to the operating system or the enrolled user. The vulnerability affects only confidentiality; integrity and availability are not impacted.
Root Cause
The root cause is classified as [CWE-359], where the affected component does not adequately restrict which callers may receive private data. In this case, the Windows Biometric Service returns information to local, authenticated principals without enforcing sufficient authorization checks on the data being disclosed. Because biometric services handle identity-linked material, any weakening of access controls elevates the sensitivity of the disclosed data beyond a typical information leak.
Attack Vector
Exploitation requires local access to an affected Windows host and a valid low-privileged account. No user interaction is needed, and the attack does not cross a security boundary beyond the local system. A malicious application or logged-in user can invoke the biometric service interfaces and receive private data belonging to other users or the system itself. No public proof-of-concept or in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
No verified public exploit code exists for this vulnerability. Refer to the Microsoft Update Guide for CVE-2026-73008 for technical detail.
Detection Methods for CVE-2026-73008
Indicators of Compromise
- Unexpected local processes making repeated calls to the Windows Biometric Service (wbiosrvc.dll hosted in svchost.exe).
- Non-interactive or low-privileged accounts accessing biometric enrollment files under %WINDIR%\System32\WinBioDatabase\.
- Anomalous invocation of the Windows Biometric Framework API (winbio.dll) from user-mode applications not associated with sign-in flows.
Detection Strategies
- Audit process creation events (Event ID 4688) for uncommon binaries opening handles to biometric service RPC endpoints.
- Monitor file access telemetry against the biometric database directory for reads by non-SYSTEM principals.
- Correlate low-privileged user activity with calls to biometric APIs, which typically originate only from LogonUI or credential providers.
Monitoring Recommendations
- Enable object access auditing on Windows Biometric Service registry keys under HKLM\SYSTEM\CurrentControlSet\Services\WbioSrvc.
- Forward Sysmon and Windows Security logs to a centralized SIEM to baseline normal biometric service callers.
- Alert on unusual RPC client behavior targeting the biometric service on servers where biometric hardware is not deployed.
How to Mitigate CVE-2026-73008
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Update Guide for CVE-2026-73008 to all affected Windows 10, Windows 11, and Windows Server systems.
- Prioritize patching endpoints that use Windows Hello or third-party biometric authentication providers.
- Review local account inventories and remove unnecessary interactive logon rights on shared or multi-user systems.
Patch Information
Microsoft has published a security update through the Microsoft Update Guide for CVE-2026-73008. Administrators should deploy the update via Windows Update, Windows Server Update Services (WSUS), or Microsoft Endpoint Configuration Manager according to their standard patch management process.
Workarounds
- Disable the Windows Biometric Service (WbioSrvc) on systems that do not require biometric authentication until patches are deployed.
- Restrict interactive and remote interactive logon on affected hosts to trusted administrative users only.
- Enforce application allowlisting to prevent untrusted binaries from invoking biometric service APIs.
# Temporarily disable the Windows Biometric Service where biometric auth is not required
sc.exe config WbioSrvc start= disabled
sc.exe stop WbioSrvc
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
