Windows Boot Manager CVE-2026-47656

Exploitation requires local access to the target system and pre-existing high privileges (administrative rights on Windows), per the CVSS vector AV:L/PR:H - this is not a remote or unauthenticated attack and cannot be triggered over the network or by a standard user. The attacker must be able to invoke Boot Manager code paths, which in practice means the ability to modify boot configuration data, EFI system partition contents, or BCD entries, and then trigger a reboot. No user interaction is required (UI:N), and the attack complexity is low (AC:L), so once admin is held the bypass is reliable. Limiting factors that reduce realistic risk: the admin-privilege requirement means this is a post-compromise capability rather than an entry vector, and systems enforcing BitLocker with TPM+PIN or Measured Boot remote attestation may detect the tampering even if the bypass itself succeeds.

The CVSS vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N tells a nuanced story: exploitation requires local access and pre-existing high privileges (administrative), but once those conditions are met the attack is low-complexity, requires no user interaction, and crosses a security scope boundary with high confidentiality and integrity impact. This profile is characteristic of post-compromise persistence or tamper-resistance bypass rather than initial access - an attacker who already has admin would use this to defeat Secure Boot, BitLocker, or Virtualization-Based Security to install a bootkit or evade endpoint controls. EPSS data was not provided in the input, the CVE is not present on CISA KEV, and no POC is referenced, so this is best treated as a defense-in-depth patching priority for high-assurance fleets rather than an emergency. The 'authorized attacker' wording in the description aligns with PR:H in the vector, so signals are internally consistent.

An attacker who has already obtained administrative privileges on a Windows endpoint - for example through a phishing-delivered token theft followed by UAC bypass - writes a crafted boot configuration or replaces a boot component, then reboots the machine; the flawed protection mechanism in Boot Manager fails to reject the tampered state, allowing pre-OS code to run outside the Secure Boot trust chain and persist beneath the operating system as a bootkit that survives OS reinstall. No public exploit identified at time of analysis, but the low attack complexity means weaponization by an attacker who already holds admin is straightforward once the protection-mechanism gap is understood.