CVE-2026-50661

CVE Enrichment

CVSS: 4.6 MEDIUM
EPSS: 0.48%
EPSS Percentile: 41.31%
CISA KEV: Not listed

Description

Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 15-Jul-2026 01:17
Last Modified: 22-Jul-2026 22:21
EPSS Date: 2026-10-27
CWE: CWE-693

CVSS Vector


            CVSS:3.1                            AV:P /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:N /
                            A:N

Affected Products / Versions

microsoft / windows_10_1607 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.14393.9339
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*
microsoft / windows_10_1607 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.14393.9339
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
microsoft / windows_10_1809 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.17763.9020
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
microsoft / windows_10_1809 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.17763.9020
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
microsoft / windows_10_21h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.19044.7548
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*
microsoft / windows_10_21h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.19044.7548
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*
microsoft / windows_10_21h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.19044.7548
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*
microsoft / windows_10_22h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.19045.7548
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*
microsoft / windows_10_22h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.19045.7548
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*
microsoft / windows_10_22h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.19045.7548
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*
microsoft / windows_11_24h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.26100.8875
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*
microsoft / windows_11_24h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.26100.8875
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*
microsoft / windows_11_25h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.26200.8875
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*
microsoft / windows_11_25h2 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.26200.8875
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:*
microsoft / windows_11_26h1 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.28000.2525
cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:*
microsoft / windows_11_26h1 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.28000.2525
cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:*
microsoft / windows_server_2016 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.14393.9339
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
microsoft / windows_server_2019 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.17763.9020
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
microsoft / windows_server_2022 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.20348.5386
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
microsoft / windows_server_2025 Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 10.0.26100.33158
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*

References

[email protected]

Last enrichment sync: 28-Oct-2026 20:40
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

The third zero-day was publicly disclosed but is not under attack: CVE-2026-50661, another BitLocker bypass. Microsoft Patches Record 622 CVEs, Including Two Actively Exploited Zero-Days
Another security defect that Microsoft drew attention to is CVE-2026-50661, a BitLocker security feature bypass issue that can be exploited by physical attackers and which was publicly disclosed before the July 2026 Microsoft Patches 622 Vulnerabilities, Including Two Exploited Zero-Days
CVE-2026-50661 is a publicly disclosed BitLocker bypass that could expose encrypted data on physically accessed devices. Microsoft July 2026 Patch Tuesday Fixes 570 Flaws, Including Three Zero-Days

CVE (10)

People (6)

Vendors (1)

Products (13)

Tools (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.