What is the CVSS score of CVE-2026-45656?

CVE-2026-45656 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Windows UEFI are affected by CVE-2026-45656?

Windows UEFI firmware contains a protection mechanism bypass (CVE-2026-45656, CVSS 7.8) enabling authenticated local users to circumvent security controls with potential impact to system…. A patch is available.

How to fix or mitigate CVE-2026-45656?

Within 24 hours: Inventory Windows systems running affected UEFI versions; audit local user privilege levels and disable unnecessary local accounts. Within 7 days: Enforce UEFI Secure Boot where hardware-supported; implement access controls restricting local authentication to necessary personnel only; enable any available firmware-level security features. Within 30 days: Establish escalation process with Microsoft (secure@microsoft.com) for patch availability; deploy system-level monitoring for privilege escalation; complete security baseline review for firmware configurations.

Windows UEFI CVE-2026-45656

EUVD-2026-35696 HIGH

Protection Mechanism Failure (CWE-693)

2026-06-09 secure@microsoft.com

GHSA-44jf-fmcv-xp6f

Authentication Bypass Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.8

CVSS 3.1 · Vendor: microsoft

Temporal: 6.8

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.8 MEDIUM

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:01 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.8

DescriptionCVE.org

Protection mechanism failure in Windows UEFI allows an authorized attacker to bypass a security feature locally.

AnalysisAI

Security feature bypass in Windows UEFI allows an authenticated local attacker with low privileges to circumvent a protection mechanism, resulting in high confidentiality, integrity, and availability impact on the host. The flaw is rooted in CWE-693 (Protection Mechanism Failure) within the Windows UEFI firmware layer, and Microsoft (secure@microsoft.com) is the reporting CNA. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

UEFI (Unified Extensible Firmware Interface) is the pre-boot firmware environment that initializes hardware and hands control to the operating system loader; on Windows systems it underpins Secure Boot, BitLocker measurement, and the early boot trust chain. CWE-693 (Protection Mechanism Failure) indicates that an existing security control in the UEFI implementation is bypassed or rendered ineffective rather than missing entirely - typical examples in this class include flaws that defeat Secure Boot, variable write protection, SMM lockdown, or Boot Guard. No CPE strings were provided in the input, so the exact affected Windows builds and firmware components must be confirmed via the Microsoft Security Update Guide entry referenced by NVD.

RemediationAI

Apply the Microsoft security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45656 as soon as it is published for your Windows edition; patch available per vendor advisory, though no specific fixed build number is provided in the input data, so consult that advisory for the exact KB and any firmware/UEFI capsule updates that must accompany the OS patch. As compensating controls while patching is staged, restrict local interactive and administrative access on affected hosts since exploitation requires PR:L local privileges (trade-off: tighter local admin controls may impede support workflows), enable and monitor Secure Boot and measured boot attestation via tools such as Microsoft Defender for Endpoint or Azure Attestation to detect bypass attempts (trade-off: attestation will flag legitimate firmware changes), and keep BitLocker enabled with TPM+PIN where feasible so that a firmware-level security bypass does not trivially lead to offline data exposure (trade-off: TPM+PIN adds boot friction for end users).