CVE-2026-27928

HighCVSS 8.7/10Last modified Oct 26, 2026

Description

Improper input validation in Windows Hello allows an unauthorized attacker to bypass a security feature over a network.

Metrics

CVSS 3.1 8.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
MicrosoftWindows Server 2016>= 10.0.14393.0, < 10.0.14393.9060
MicrosoftWindows Server 2016 (Server Core installation)>= 10.0.14393.0, < 10.0.14393.9060
MicrosoftWindows Server 2019>= 10.0.17763.0, < 10.0.17763.8644
MicrosoftWindows Server 2019 (Server Core installation)>= 10.0.17763.0, < 10.0.17763.8644
MicrosoftWindows Server 2022>= 10.0.20348.0, < 10.0.20348.5020
MicrosoftWindows Server 2022, 23H2 Edition (Server Core installation)>= 10.0.25398.0, < 10.0.25398.2274
MicrosoftWindows Server 2025>= 10.0.26100.0, < 10.0.26100.32690
MicrosoftWindows Server 2025 (Server Core installation)>= 10.0.26100.0, < 10.0.26100.32690

References

Timeline

Published
Apr 14, 2026
Last modified
Oct 26, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-279297.0Time-of-check time-of-use (toctou) race condition in Windows LUAFV allows an authorized attacker to elevate privileges locally.CVE-2026-27939.8Memory safety bugs present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bCVE-2026-279305.5Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information locally.CVE-2026-279315.5Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information locally.CVE-2026-279327.5joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In 1.6.2 and earCVE-2026-279336.8Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. VersionCVE-2026-279347.5Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a lack of visibility checkCVE-2026-279356.5Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a vulnerability in an API CVE-2026-279365.3Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a restriction bypass allows reCVE-2026-279373.1October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, a reflected Cross-Site Scripting (XSS) vulnerabilCVE-2026-279387.7WPGraphQL provides a GraphQL API for WordPress sites. Prior to version 2.9.1, the `wp-graphql/wp-graphql` repository contains a GitHub ActioCVE-2026-279398.8Statmatic is a Laravel and Git powered content management system (CMS). Starting in version 6.0.0 and prior to version 6.4.0, Authenticated