CVE-2026-20852CWE-266

CVE-2026-20852

High · published January 13, 2026

CVSS v3.1
7.7
EPSS
1%
Percentile
42.0
In the wild
Unconfirmed
What it is

⚡ An incorrect privilege assignment in Windows Hello could let an unauthorized user tamper with your device locally—yikes! 😱 Think of Windows Hello as a fancy security guard at the entrance of a VIP club. If the guard mistakenly lets someone in without the proper credentials, that rogue guest can wreak havoc on the party, rearranging the guest list and causing chaos! This vulnerability allows an attacker to perform unauthorized actions on your device, potentially leading to data manipulation or other malicious activities. Imagine someone strolling in uninvited and changing the music playlist to all the worst songs—absolutely devastating for everyone else!

Put simply

Think of Windows Hello as a fancy security guard at the entrance of a VIP club. If the guard mistakenly lets someone in without the proper credentials, that rogue guest can wreak havoc on the party, rearranging the guest list and causing chaos! The flaw arises from improper privilege assignments in Windows Hello, allowing unauthorized users to access sensitive features and tamper with system settings locally without proper authentication.

What to do

This vulnerability allows an attacker to perform unauthorized actions on your device, potentially leading to data manipulation or other malicious activities. Imagine someone strolling in uninvited and changing the music playlist to all the worst songs—absolutely devastating for everyone else! To remediate this, ensure that your system is fully updated to the latest version where this issue is patched. Regularly review user permissions and consider implementing stricter access controls to limit who can make changes. Don't forget to monitor for any suspicious activity! You've got this! 💪 Follow these steps, and you'll have your system secured in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00501 · 42.0th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2026-01-13T23:16Z
Affected products (14)
ProductVersionsFixed in
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_21h2< 10.0.19044.680910.0.19044.6809
microsoft/windows_10_22h2< 10.0.19045.680910.0.19045.6809
microsoft/windows_11_23h2< 10.0.22631.649110.0.22631.6491
microsoft/windows_11_24h2< 10.0.26100.762310.0.26100.7623
microsoft/windows_11_25h2< 10.0.26200.762310.0.26200.7623
microsoft/windows_server_2016< 10.0.14393.878310.0.14393.8783
microsoft/windows_server_2019< 10.0.17763.827610.0.17763.8276
microsoft/windows_server_2022< 10.0.20348.464810.0.20348.4648
microsoft/windows_server_2022_23h2< 10.0.25398.209210.0.25398.2092
microsoft/windows_server_2025< 10.0.26100.3223010.0.26100.32230
References (1)
EPSS history
Timeline
  • 13 JAN 17:56Z
    Windows Hello Tampering Vulnerability
    cvelistv5