CVE-2026-72980 – Windows Hello Security Feature Bypass Vulnerability
CVSS 4.4
MODERATE
Critical - Same Day Deployment
“A local attacker with high privileges could bypass Windows Hello protections and expose confidential information.”
CVE-2026-72980 is a Windows Hello security feature bypass vulnerability caused by an uncontrolled search path element (CWE-427). An authorized local attacker with high privileges could exploit the issue to bypass the Windows Hello security feature. Successful exploitation can result in a high confidentiality impact, although no integrity or availability impact is identified.
Key Details
- Attack Vector
- Local
- Attack Complexity
- Low
- Privileges Required
- High
- User Interaction
- None
- CWE Classification
- CWE-427
Patch this CVE on all your endpoints in under 5 minutes.
First 200 endpoints are free forever, scale as needed.