Newshot Article title: Microsoft Discloses Windows BitLocker Vulnerabilities That Allow Physical Access to Bypass Encryption Protections
Body:
Microsoft recently disclosed two Windows BitLocker security feature bypass vulnerabilities. Attackers with physical access to a device can exploit these vulnerabilities to weaken device protections.
The two vulnerabilities were publicly disclosed on November 10, 2026, and are tracked as CVE-2026-97015 and CVE-2026-119832. Both vulnerabilities have a severity rating of "Important," with CVSS base scores of 6.8 and 5.9, respectively. Because their root causes and the access conditions required for exploitation differ, security teams need to assess them separately.
The two vulnerabilities have different root causes, and exploitation requires no user interaction
Attackers can exploit CVE-2026-119832 to bypass the BitLocker Device Encryption mechanism for system storage devices and directly access encrypted data. Exploiting this vulnerability requires physical access to the device and basic user privileges; it does not require another user to click a link, open a file, or confirm a prompt.
CVE-2026-97015 is caused by a heap buffer overflow and maps to the CWE-122 classification. This type of vulnerability is triggered when software writes data to addresses outside the memory space reserved for a buffer. An unauthorized attacker can exploit this vulnerability through physical contact with the device to bypass security protections. The entire exploitation process requires no existing system privileges and no user interaction, and the attack complexity rating is Low.
Unlike CVE-2026-97015, which results from a memory handling error, CVE-2026-119832 is an improper access control vulnerability. Exploiting it requires only low privileges and likewise requires no user interaction.
According to the security advisory, at the time the patch was released, CVE-2026-119832 had not been publicly disclosed, and no cases of exploitation in the wild had been found. The official assessment is that the likelihood of an attacker actually exploiting this vulnerability is low, and the researcher who discovered the vulnerability, yhw, was credited.
The vulnerabilities cover multiple versions of Windows, and corresponding patches have been officially released
The vulnerabilities disclosed this time are the latest security issues officially published, following the October 2026 BitLocker security update and earlier BitLocker bypass vulnerabilities. CVE-2026-119832 affects Windows 10 versions 1809, 21H2, and 22H2, multiple generally available Windows 11 versions, and Windows Server 2019, 2022, and 2025, with differences in the supported processor platforms across versions.
CVE-2026-97015 affects a broader range of products and also covers earlier Windows Server branches. Administrators need to check the affected scope lists for both vulnerabilities separately and should not rely on a single generic list of affected devices.
For CVE-2026-119832, the official patches are listed for different systems: affected Windows 10 21H2 and 22H2 systems need to install KB5131096, Windows 11 23H2 systems need to install KB5131087, and Windows 11 26H1 systems need to install KB5132059. For server versions, the corresponding patch for Windows Server 2019 is KB5131085, and the corresponding patch for Windows Server 2022 is KB5131090.
Windows BitLocker Vulnerabilities Allow Attackers to Bypass Security Feature