Windows BitLocker Vulnerabilities Allow Attackers to Bypass Security Feature

Microsoft has disclosed two Windows BitLocker security feature bypass vulnerabilities that could allow attackers with physical access to weaken device protections.

Published on November 10, 2026, the flaws are tracked as CVE-2026-97015 and CVE-2026-119832. Microsoft rates both as Important, with CVSS base scores of 6.8 and 5.9, respectively. The bugs have different causes and access requirements, so security teams should assess each separately.

For CVE-2026-119832, Microsoft confirms that a successful attacker could bypass BitLocker Device Encryption on the system storage device and access encrypted data.

The attack requires physical access and basic user privileges. It does not require another user to click a link, open a file, or approve a prompt. CVE-2026-97015 stems from a heap-based buffer overflow, classified as CWE-122. This type of flaw occurs when software writes beyond the memory space reserved for a buffer.

Windows BitLocker Vulnerabilities

Microsoft says an unauthorized attacker can use the weakness to bypass a security feature through a physical attack. No existing privileges or user interaction are required, and attack complexity is rated low.

CVE-2026-119832 involves improper access control rather than a memory handling error. An attacker needs low privileges, but exploitation requires no user interaction.

According to Microsoft’s advisory, the vulnerability was not publicly disclosed or known to be exploited at the time of release. Microsoft rates exploitation as less likely and credits researcher yhw.

These disclosures follow earlier Windows BitLocker bypass vulnerabilities and the October 2026 BitLocker security updates. CVE-2026-119832 affects Windows 10 versions 1809, 21H2, and 22H2, several Windows 11 releases, and Windows Server 2019, 2022, and 2025. Supported processor platforms vary by release.

CVE-2026-97015 has a broader affected product list that also includes older Windows Server branches. Administrators should check both records rather than rely on a single shared device list.

Microsoft lists KB5131096 for affected Windows 10 21H2 and 22H2 systems, KB5131087 for Windows 11 23H2, and KB5132059 for Windows 11 26H1 under CVE-2026-119832. Server updates include KB5131085 for Server 2019 and KB5131090 for Server 2022.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Windows BitLocker Vulnerabilities Allow Attackers to Bypass Security Feature appeared first on Cyber Security News.