Windows Server 2016 CVE-2026-27928

Windows Hello must be enabled and configured as the primary authentication mechanism. Attacker requires network access to the target system. Exploitation requires high complexity conditions (AC:H) not specified in description; likely timing-dependent or requires specific system state. No user interaction needed.

Real-world risk is significant but constrained by attack complexity. CVSS 8.7 reflects Critical severity with network attack vector (AV:N) requiring no user interaction (UI:N) or privileges (PR:N), but high attack complexity (AC:H) suggests exploitation requires precise timing, race conditions, or deep protocol knowledge. The scope change elevates impact beyond authentication bypass to potential domain-level compromise if Hello is used for privileged access. However, absence from CISA KEV indicates no confirmed exploitation campaigns, and lack of public POC reduces immediate weaponization risk. SSVC decision framework considerations: exploitation status is 'none' (no KEV/POC), automatable is 'no' (AC:H contradicts automation), technical impact is 'total' (authentication bypass with scope escape). Priority depends heavily on environmental factors-organizations using Windows Hello for Business in Server environments face substantially higher risk than those relying solely on traditional authentication. EPSS data not provided, but the narrow attack surface (Hello deployment) and complexity likely result in low probability scores despite high CVSS.

An attacker with network access to a Windows Server 2022 domain controller utilizing Windows Hello for Business sends specially crafted authentication protocol messages to the Hello credential provider service, exploiting insufficient input validation in the biometric/PIN verification handshake. Despite high attack complexity requiring precise manipulation of Hello's certificate-based authentication flow or timing-dependent exploitation of validation race conditions, successful exploitation allows complete authentication bypass without valid credentials. The attacker establishes authenticated sessions with domain administrator privileges, enabling lateral movement across the Active Directory environment and access to sensitive resources protected by the compromised authentication boundary.