CVE-2026-70280: Windows Hello Security Feature Bypass Vulnerability

Overview

Severity
Medium (CVSS 4.4)
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Category
Security Feature Bypass
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2026-Oct
Released
2026-10-13
EPSS Score
0.38% (percentile: 30.2%)

Description

Incorrect authorization in Windows Hello allows an authorized attacker to bypass a security feature locally.

FAQ

What kind of security feature could be bypassed by successfully exploiting this vulnerability? This vulnerability could allow an attacker to bypass the Windows biometric authentication feature. A malicious biometric device could be incorrectly recognized as trusted, allowing an attacker to falsely present biometric data and potentially gain access to the device without the legitimate user's fingerprint or face.

Affected Products (16)

Windows

  • Windows 10 Version 21H2 for 32-bit Systems
  • Windows 10 Version 21H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for x64-based Systems
  • Windows 11 Version 25H2 for ARM64-based Systems
  • Windows 11 Version 25H2 for x64-based Systems
  • Windows 11 Version 23H2 for ARM64-based Systems
  • Windows 11 Version 23H2 for x64-based Systems
  • Windows 11 Version 24H2 for ARM64-based Systems
  • Windows 11 Version 24H2 for x64-based Systems
  • Windows 11 version 26H1 for x64-based Systems
  • Windows 11 Version 26H1 for ARM64-based Systems
  • Windows 11 Version 26H2 for ARM64-based Systems
  • Windows 11 Version 26H2 for x64-based Systems

ESU

  • Windows 10 Version 22H2 for x64-based Systems
  • Windows 10 Version 22H2 for ARM64-based Systems
  • Windows 10 Version 22H2 for 32-bit Systems

Security Updates (4)

Acknowledgments

<a href="https://linkedin.com/in/dr-sr">Dan Reynolds</a> with MSRC Vulnerabilities &amp; Mitigations

Revision History

  • 2026-10-13: Information published.