CVE-2026-23670

CWE-8222 documents2 sources

Severity

5.7MEDIUM

EPSS

No EPSS data

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Microsoft Windows 10 Version 1607 Microsoft Windows 10 Version 1809 Microsoft Windows 10 Version 21h2 +13 more

Timeline

PublishedApr 14

Description

Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:NExploitability: 0.5 | Impact: 5.2

Affected Packages16 packages

▶CVEListV5microsoft/windows_server_201610.0.14393.0 — 10.0.14393.9060

▶CVEListV5microsoft/windows_server_201910.0.17763.0 — 10.0.17763.8644

▶CVEListV5microsoft/windows_server_202210.0.20348.0 — 10.0.20348.5020

▶CVEListV5microsoft/windows_server_202510.0.26100.0 — 10.0.26100.32690

▶CVEListV5microsoft/windows_10_version_160710.0.14393.0 — 10.0.14393.9060

🔴Vulnerability Details

CVEList

Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability↗2026-04-14

▶