CVE-2026-72980 – Windows Hello Security Feature Bypass Vulnerability

CVE-2026-72980 is a Windows Hello security feature bypass vulnerability caused by an uncontrolled search path element (CWE-427). An authorized local attacker with high privileges could exploit the issue to bypass the Windows Hello security feature. Successful exploitation can result in a high confidentiality impact, although no integrity or availability impact is identified.

CVSS SCORE: 4.4.

SEVERITY: Critical.

THREAT: The vulnerability creates a risk to Windows Hello protections on affected Windows systems. Exploitation requires local access and high privileges, but attack complexity is low and no user interaction is required. A successful attack could bypass a security feature and compromise confidentiality.

EXPLOITS: Exploitation is assessed as unlikely. The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as unproven, so confirmed public exploit, zero-day exploitation, or proof-of-concept code cannot be established.

TECHNICAL SUMMARY: The vulnerability results from an uncontrolled search path element in Windows Hello, identified as CWE-427. An authorized attacker operating locally with high privileges could take advantage of this condition to bypass the Windows Hello security feature. The attack has low complexity and requires no user interaction. The CVSS metrics identify a high confidentiality impact, with no impact to integrity or availability and no change in security scope.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2 and 26H1; and Windows Server 2016, 2019, 2022 and 2025, including the listed Server Core installations. Exploitation requires local access and high privileges but no user interaction.

BUSINESS IMPACT: A successful security feature bypass could weaken an organization’s reliance on Windows Hello and expose confidential information on compromised systems. The need for high privileges limits the attack path, but the low attack complexity means an attacker who already has sufficient local privileges could potentially use the flaw without involving a user.

WORKAROUND: No mitigations or workarounds are identified. An official fix is available, making patch deployment the identified remediation path.

URGENCY: This vulnerability is rated Critical across the affected Windows products and should be prioritized for deployment. While it is not publicly disclosed or known to be exploited, successful exploitation could bypass Windows Hello protections and have a high confidentiality impact.