Cyber Posture

CVE-2026-27928

High

Published: 14 April 2026

Published
14 April 2026
Modified
22 April 2026
KEV Added
Patch
CVSS Score 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
EPSS Score 0.0015 35.5th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Description

Improper input validation in Windows Hello allows an unauthorized attacker to bypass a security feature over a network.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly requires validation of all information inputs to the Windows Hello biometric authentication system, comprehensively addressing the improper input validation (CWE-20) vulnerability exploited over the network.

prevent

Mandates unique identification and authentication for organizational users via robust mechanisms like Windows Hello, preventing unauthorized bypass of biometric security features.

prevent

Requires timely identification, reporting, and remediation of flaws such as CVE-2026-27928 through patching, directly countering the vulnerability per MSRC guidance.

Security SummaryAI

CVE-2026-27928 is an improper input validation vulnerability (CWE-20) affecting Windows Hello, a biometric authentication feature in Microsoft Windows. Published on 2026-04-14T18:17:04.170, it carries a CVSS v3.1 base score of 8.7 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N), indicating high severity due to its network accessibility and potential for significant confidentiality and integrity impacts.

An unauthorized attacker with network access can exploit this vulnerability despite high attack complexity, requiring no privileges or user interaction. Exploitation enables bypassing a security feature in Windows Hello, resulting in high confidentiality and integrity violations within a changed scope.

The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27928 provides details on mitigation and patching guidance.

Details

CWE(s)

Affected Products

microsoft
windows server 2016
≤ 10.0.14393.9060
microsoft
windows server 2019
≤ 10.0.17763.8644
microsoft
windows server 2022
≤ 10.0.20348.5020
microsoft
windows server 2022 23h2
≤ 10.0.25398.2274
microsoft
windows server 2025
≤ 10.0.26100.32690

MITRE ATT&CK Enterprise TechniquesAI

T1211 Exploitation for Stealth Stealth
Adversaries may exploit vulnerabilities to evade detection by hiding activity, suppressing logging, or operating within trusted or unmonitored components.
Why these techniques?

The vulnerability allows bypassing Windows Hello, a biometric authentication security feature, via improper input validation, directly mapping to exploitation of software vulnerabilities for defense evasion.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References