CVE-2026-116638

HighCVSS 7.5/10Last modified Oct 30, 2026

Description

The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including administrator-configured UEFI/BIOS passwords. An attacker with physical or administrative access to a device may be able to leverage WinRE-related boot mechanisms to circumvent firmware protections and gain unauthorized access to system resources.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-288

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

Timeline

Published: Oct 26, 2026
Last modified: Oct 30, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1166393.5A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd. Affected i CVE-2026-116648.8Use after free in Payments in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a c CVE-2026-1166403.5A flaw has been found in Saruf-Ratul HR-Payroll-Management-System e7cd81477001afdee95b843fd4137894d9418c9f/3fd6f45ead9f8197510c0910f759e06ee CVE-2026-1166416.8The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store. However, the crypto/x509 CVE-2026-1166457.1LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export CVE-2026-1166464.3Tanium addressed an uncontrolled resource consumption vulnerability in Threat Response.CVE-2026-1166477.1Tanium addressed an improper output sanitization vulnerability in Comply.CVE-2026-1166484.1Tanium addressed an improper output sanitization vulnerability in Discover.CVE-2026-1166497.1Tanium addressed an improper output sanitization vulnerability in Enforce.CVE-2026-116654.3Out of bounds read in Dawn in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to leak cross-origin data via a cra CVE-2026-1166507.5Tanium addressed an unauthorized code execution vulnerability in Threat Response.CVE-2026-1166517.5Tanium addressed an unauthorized code execution vulnerability in Threat Response.