Summary
Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
According to the CVSS metric, successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?
This vulnerability could lead to the attacker gaining the ability to interact with other tenant’s applications and content.
According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to prepare the target environment to improve exploit reliability.
What kind of security feature could be bypassed by successfully exploiting this vulnerability?
An attacker who successfully exploited this vulnerability could bypass the MFA required for Windows Hello for Business PIN provisioning.
Please see Windows Hello for Business PIN provisioning for updated details.
Security updates
10.0.17763.8644 — https://support.microsoft.com/help/5082123
10.0.20348.5020 — https://support.microsoft.com/help/5082142
10.0.26100.32690 — https://support.microsoft.com/help/5082063
10.0.25398.2274 — https://support.microsoft.com/help/5082060
10.0.14393.9060 — https://support.microsoft.com/help/5082198
Vulnerabilities 1
-
High 8.7
Windows Hello Security Feature Bypass Vulnerability
Improper input validation in Windows Hello allows an unauthorized attacker to bypass a security feature over a network.
Revision history
-
#1
Information published.
References
-
CVE-2026-27928 Windows Hello Security Feature Bypass Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27928
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss