MICROSOFT-CVE-2026-20928

MEDIUM4.6

Windows Recovery Environment Security Feature Bypass Vulnerability

Published Apr 28, 2026

Modified 1 weeks ago

Details

Improper removal of sensitive information before storage or transfer in Windows Recovery Environment Agent allows an unauthorized attacker to bypass a security feature with a physical attack.

References

ADVISORY

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20928

CVSS Analysis

CVSS v2.0

4.6

Upstream

CVE-2026-20928

Ecosystems

Timeline

PublishedApr 28, 2026

ModifiedApr 28, 2026