This vulnerability, identified as CWE-212, involves improper removal of sensitive information in the Windows Recovery Environment Agent on Windows 10 Version 1607 (build 10.0.14393.0). The flaw enables an attacker with physical access to bypass security protections by exploiting residual sensitive data that should have been cleared before storage or transfer. The CVSS 3.1 base score is 4.6, reflecting medium severity with attack vector requiring physical access but low complexity and no privileges or user interaction needed. Microsoft has issued an official fix for this vulnerability.

An attacker with physical access to a system running the affected Windows 10 Version 1607 can bypass a security feature due to residual sensitive information not being properly cleared. This could lead to unauthorized access to sensitive data. There is no indication of impact on integrity or availability. No known exploits are reported in the wild.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20928 to remediate this vulnerability.