CVE-2026-58638

Windows Boot Loader Security Feature Bypass Vulnerability

No known exploitation. EPSS puts it in the 13th percentile. A vendor fix is available.

CVSS 3.16.0Medium EPSS percentile13th0.2% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-07-14Updated 2026-07-22Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check which of these you run: windows 10, windows 11, windows server 2012, windows server 2012 r2, windows server 2016, windows server 2019, windows server 2022, windows server 2025.
Compare your current Windows build/version against the fixed versions listed in this advisory (below in your IT ticket) for your exact OS.
Update each affected machine to the fixed version for your platform (do this even if you believe the machine is “safe,” because the issue is in the boot loader security feature).
If you can’t patch immediately, limit “local access” to Windows accounts (reduce who can log on to consoles/terminals) and protect physical/interactive access until updates are applied.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Missing cryptographic step in Windows Boot Loader allows an authorized attacker to bypass a security feature locally.

In plain language

Written by AI from the record

CVE-2026-58638 is a Windows problem where a user with local access can bypass a security feature; if you only use Windows normally (no special local/admin exposure), it’s less likely, but RED means you should patch these Windows versions.

CVE-2026-58638 is a security-feature bypass in the Windows Boot Loader: a missing cryptographic check lets a local, authorized attacker bypass a security control (no user interaction required), affecting Windows 10/11 and multiple Windows Server releases.

If you're affected

Security controls bypassed locally
Potential credential or data theft
Device takeover without reboot effort
Incident response and downtime risk

What is it

Think of Windows security as a locked gate that only opens when the “proof” is correct. This CVE is like a missing proof-check in the Windows boot process, so someone who already has local access may be able to get around that gate. The impact is that a bad actor who can reach the device locally may defeat a security protection meant to prevent compromise.

Who is affected

This matters if you run affected Windows desktop/server operating systems: windows 10, windows 11, and the listed Windows Server editions. The key risk is for scenarios where an attacker already has local access to the machine (for example, they can log on locally or otherwise gain authorized local access). Based on the findings, it’s only a risk where the attacker has local access; the detailed “default reachable” conditions are not yet known.

How urgent is it

This is RED because it targets the Windows Boot Loader security feature, which is a foundational protection. Even though public exploit code isn’t on record and there’s no clear dated press exploitation claim, attackers with local access don’t need much else to use a security-feature bypass. Patch these systems promptly, focusing first on machines that could be accessed locally by untrusted staff, visitors, or anyone outside your normal administrative control.

What to do — in detail

Identify exposure
- Inventory all endpoints/servers running: windows 10, windows 11, windows server 2012, windows server 2012 r2, windows server 2016, windows server 2019, windows server 2022, windows server 2025.
- On each system, confirm its current Windows build/version (what your IT system management tool reports).
Determine whether you are already fixed
- Apply the fixed-version mapping below to your exact edition:
  - windows 10: fixed in 10.0.17763.9020; 10.0.19044.7548; 10.0.19045.7548
  - windows 11: fixed in 10.0.26100.8875; 10.0.28000.2525
  - windows server 2012: fixed in 6.2.9200.26226
  - windows server 2012 r2: fixed in 6.3.9600.23291
  - windows server 2016: fixed in 10.0.14393.9339
  - windows server 2019: fixed in 10.0.17763.9020
  - windows server 2022: fixed in 10.0.20348.5386
  - windows server 2025: fixed in 10.0.26100.33158
- If your current build matches or exceeds the relevant fixed version for your OS, you’re fixed for this CVE per the provided patch data.
Upgrade / patch plan
- Prioritize machines with higher likelihood of local access by non-trusted parties (shared workstations, reception PCs, devices used on-site by contractors).
- Schedule updates to minimize disruption; boot-loader changes generally require a reboot to fully take effect.
Temporary workaround if patching is delayed
- Reduce local/interactive access: restrict who can log on at the console or via local sessions, and tighten physical access controls.
- Review local admin group membership and remove unnecessary accounts with local access.
Validate and monitor
- After updating, confirm the build/version matches the fixed versions above and that the machine reboots successfully.
- Monitor for signs of unauthorized local access (e.g., unusual local logons, new local accounts, or unexpected changes to security-related settings), since the described threat model starts with local access.
KEV / due date
- KEV: not listed in CISA KEV (no due date provided in the findings).

Technical context

CVE-2026-58638 is a Windows Boot Loader security-feature bypass involving a missing cryptographic check (CWE-325). The findings describe a local attack model with high authentication requirements and no user interaction, meaning an attacker must already have authorized local access on the machine. KEV is not listed, and there is no public exploit code recorded; press reports do not include a clear dated exploitation claim. A patch is available with fixed versions provided for multiple Windows 10/11 and Windows Server releases. The CVSS is scored as medium in the input data, but the affected component (boot-loader security feature) makes remediation a priority because it undermines protections early in the boot/trust chain.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS13th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.2% chance of exploitation activity in the next 30 days, which ranks it in the 13th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

10 events over 8 days, from the signal feeds we watch.

2026-07-22Patch availablerecord updated
2026-07-17Patch availablerecord updated
2026-07-16OpenVAS check added
2026-07-15Record updated
2026-07-14Publishedweakness classified, record updated, record updated

Affected products

Microsoftcommercial · US

And 21 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Scored 6.0 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required HighRequires admin or elevated privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability NoneNo availability impact

Weaknesses

CWE-325No name in the record

Sources

References in the record

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58638

In the news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Windows 10 Version 1809, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account