Windows Boot Manager CVE-2026-77892

Physical access to the target device is the mandatory and sole prerequisite - CVSS AV:P confirms remote exploitation is categorically impossible. The attacker must be able to interact with device hardware directly, such as attaching USB boot media, pressing power/reset controls, or manipulating UEFI firmware settings. No prior system authentication or user-level privileges are required (PR:N, UI:N). The following factors limit exploitation: the attacker must be physically present; full-disk encryption with pre-boot PIN (BitLocker TPM+PIN) substantially increases difficulty; disabled external boot device ordering in UEFI raises the bar further; and physical security controls such as locked facilities and device cable locks eliminate the attack surface entirely for secured assets. There is no configuration of the Windows Boot Manager that exposes this vulnerability to remote or network-based exploitation.

The physical attack vector (AV:P) is the primary limiting factor and significantly constrains real-world exploitability - an attacker must have hands-on access to target hardware, which prevents mass remote exploitation. Despite a CVSS base score of 6.8, the C:H/I:H/A:H impact triad reflects severe consequences if that physical bar is cleared: full pre-OS compromise with access to disk encryption keys, persistent bootkit implantation, and complete system integrity loss. This threat profile maps to supply-chain interception, insider attacks, border crossing device inspection, theft-based exfiltration, and Evil Maid scenarios against unattended devices. EPSS data is not provided in the available intelligence; physical-vector flaws typically score low on automated exploitation probability metrics due to the inherent automation barrier. No KEV listing is recorded, and no public exploit code has been identified at time of analysis. The breadth of affected Windows versions - from Server 2012 through the latest Windows 11 and Server 2025 builds - combined with the ubiquitous deployment footprint of Windows means the aggregate attack surface is enormous even if individual exploitation requires physical presence. Organizations managing high-value mobile device fleets in executive, diplomatic, law enforcement, or defense contexts face realistic physical-access threat models and should prioritize patching.

An attacker with physical access to an unattended Windows laptop - during a hotel-room Evil Maid scenario, brief office intrusion, or border crossing device inspection - reboots the system and exploits the Boot Manager protection mechanism failure, either via crafted external boot media or UEFI variable manipulation, to bypass Secure Boot and load unauthorized pre-OS code. Execution at this stage grants the attacker full control prior to OS integrity checks, enabling extraction of BitLocker volume master keys from memory, installation of a persistent bootkit, or complete reimaging of the device. No public exploit code has been identified at time of analysis; exploitation at this sophistication level is realistic for nation-state and targeted espionage threat actors.