What is the CVSS score of CVE-2026-45658?

CVE-2026-45658 has a contested CVSS base score of 6.8 from a third party (e.g. CISA-ADP), while the vendor rates it Medium. vuln.today uses the vendor rating as authoritative.

Which versions of Windows BitLocker are affected by CVE-2026-45658?

A security feature bypass in Microsoft Windows BitLocker (CVE-2026-45658, CVSS 7.8) allows attackers with physical access to decrypt protected drives and access sensitive data.. A patch is available.

How to fix or mitigate CVE-2026-45658?

Within 24 hours: Inventory BitLocker-enabled systems and identify those containing sensitive data; assess physical security controls for each device class. Within 7 days: Implement strict physical access controls (device supervision, locked storage, movement restrictions); disable BitLocker on high-risk portable devices without adequate physical security or deploy alternative encryption solutions. Within 30 days: Monitor Microsoft security advisories for patch availability; document and escalate unmitigated systems for executive risk review.

Windows BitLocker CVE-2026-45658

EUVD-2026-35572 MEDIUM

Improper Access Control (CWE-284)

2026-06-09 secure@microsoft.com

GHSA-586f-rf9v-97r7

Authentication Bypass Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

Medium

Disputed · 6.8 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

6.8 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

CRITICAL

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Severity Changed

Jul 09, 2026 - 00:22 NVD

HIGH MEDIUM

CVSS changed

Jul 09, 2026 - 00:22 NVD

7.8 (HIGH) 6.8 (MEDIUM)

Analysis Generated

Jun 09, 2026 - 17:59 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.8

DescriptionNVD

Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

AnalysisAI

Security feature bypass in Microsoft Windows BitLocker allows an attacker with physical access to circumvent the drive encryption protection mechanism. Affected systems can have BitLocker-protected data accessed despite the encryption-at-rest control being enabled, undermining a core platform confidentiality boundary. There is no public exploit identified at time of analysis, but the vulnerability is reported by Microsoft (secure@microsoft.com) as a protection mechanism failure with high impact across confidentiality, integrity, and availability.

Technical ContextAI

BitLocker is Microsoft's full-volume encryption feature that protects data at rest on Windows systems, typically leveraging a Trusted Platform Module (TPM) to seal the volume master key and release it only when the boot environment is in a known-good state. The CWE-284 (Improper Access Control) classification indicates that an access control or protection mechanism within BitLocker - likely the pre-boot authentication, TPM unsealing flow, or recovery key handling - fails to correctly enforce its security boundary. Because BitLocker relies on the integrity of the boot chain and hardware-rooted secrets, a failure in any link of that chain (e.g., DMA exposure, unsealing logic, or recovery path validation) can allow decrypted access to volumes that should remain sealed.

RemediationAI

Apply the Microsoft security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45658 as soon as patch details are published; patch available per vendor advisory, but exact fix version is not enumerated in the provided data and must be retrieved from the MSRC page for the affected Windows build. Until the update is deployed, defenders should enable BitLocker pre-boot authentication with a PIN or USB startup key (TPM+PIN) so that a stolen device cannot be unsealed by physical access alone - note this changes the user logon experience and complicates remote/unattended reboots. Additionally, ensure Secure Boot is enabled, disable unnecessary DMA-capable external ports (Thunderbolt/FireWire) via Group Policy or firmware, enable Kernel DMA Protection on supported hardware, and physically secure or remove drives from end-of-life and lost devices; the trade-off of disabling DMA ports is reduced peripheral functionality for users who rely on docking stations and external GPUs.