Windows Server 2012 EUVD-2026-22455

Attacker requires local access to the Windows system with BitLocker enabled. No authentication or user interaction needed. Affects Windows installations with BitLocker drive encryption active. Remote exploitation not possible; physical or direct local system access mandatory.

Real-world risk assessment requires balancing CVSS severity against practical exploitation constraints. The CVSS 7.7 (High) reflects local attack vector (AV:L), low complexity (AC:L), no privileges required (PR:N), and high confidentiality/integrity impact (C:H/I:H). However, the local attack requirement fundamentally limits exploitation to scenarios involving physical device access, stolen equipment, or malicious insiders with console access. No EPSS data provided, but local-only vulnerabilities historically show lower exploitation rates than remote vectors. No KEV listing indicates no confirmed active exploitation campaigns. The absence of publicly available exploit code further reduces immediate risk. From SSVC perspective: exploitation status is publicly-available-information-only, not active; technical impact is total compromise of encrypted data confidentiality/integrity; automatable is no due to physical access requirement. This creates moderate priority for organizations with physical security controls but becomes critical for portable servers, edge deployments, or environments with insider threat concerns. The security feature bypass nature means compensating controls (physical security, device tracking) become sole protections until patched.

An attacker gains physical access to a BitLocker-encrypted Windows Server 2019 device in a branch office or during equipment transport. By exploiting the input validation flaw during the pre-boot environment or through direct manipulation of boot configuration data, the attacker bypasses BitLocker authentication without requiring TPM PIN, recovery key, or domain credentials. This grants complete access to the encrypted volume contents, allowing extraction of sensitive data, credential databases, or installation of persistent backdoors before returning the device undetected. The low attack complexity (AC:L) indicates exploitation requires only basic technical skills once physical access is achieved.