Windows BitLocker Vulnerabilities Allow Attackers to Bypass Security Feature - CyberSecurityNews
Microsoft has disclosed two Windows BitLocker security feature bypass vulnerabilities that could allow attackers with physical access to weaken device protections.
The vulnerabilities were disclosed on November 10, 2026, and are rated as Important by Microsoft. CVE-2026-119832 allows an attacker with physical access and basic user privileges to bypass BitLocker Device Encryption on a system storage device and access its data. This flaw stems from improper access control and does not require user interaction. CVE-2026-97015, on the other hand, is a heap-based buffer overflow (CWE-122) that lets an attacker bypass a security feature through a physical attack without requiring any existing privileges or user interaction.
Microsoft says an unauthorized attacker can use the weakness to bypass a security feature through a physical attack.
The affected software includes Windows 10 versions 1809, 21H2, and 22H2, several Windows 11 releases, and Windows Server 2019, 2022, and 2025. CVE-2026-97015 has a broader affected product list that also includes older Windows Server branches. Microsoft has released the following updates to address the issues: KB5131096 for Windows 10 21H2 and 22H2, KB5131087 for Windows 11 23H2, KB5132059 for Windows 11 26H1, KB5131085 for Server 2019, and KB5131090 for Server 2022.
Microsoft has not publicly disclosed the vulnerabilities or seen any known exploitation at the time of release. The company credits researcher yhw for the discovery. Administrators should apply the relevant updates and assess each vulnerability separately to ensure their systems are fully protected.
Related
