Windows Server 2016 EUVD-2026-22352

This vulnerability carries a CVSS score of 4.6 with a physical attack vector (AV:P), low complexity (AC:L), no privilege requirements (PR:N), no user interaction (UI:N), and high confidentiality impact (C:H) but no integrity or availability impact. While the CVSS score is below the high severity threshold, the real-world risk is non-trivial: physical attackers-including law enforcement, malicious insiders, or theft scenarios-can recover sensitive information that bypasses security features (such as encryption or authentication). The physical attack vector limits the attacker population significantly compared to remote exploits, but for high-value targets (government, enterprise, forensic subjects) the impact of information disclosure is substantial. The broad affected product range (Windows 10, 11, Server 2016-2025) and the availability of vendor patches suggest Microsoft recognizes this as a legitimate security defect rather than a theoretical issue.

An attacker with physical access to a Windows device (stolen laptop, seized server, or compromised system) powers it on and boots into or accesses the Windows Recovery Environment. The attacker then extracts sensitive information (such as BitLocker recovery keys, cached credentials, or encryption material) that the Recovery Environment Agent failed to properly purge from RAM or persistent storage. With this information, the attacker can bypass encryption, authentication, or other security features protecting the system or user data.