This vulnerability (CVE-2026-26175) is classified as CWE-908 (Use of Uninitialized Resource) and affects the Windows Boot Manager component in Windows 10 Version 1607 (build 10.0.14393.0). The flaw allows an attacker with physical access to bypass security protections due to improper initialization of resources during boot. The CVSS v3.1 base score is 4.6, reflecting a medium severity with attack vector requiring physical access, low attack complexity, no privileges or user interaction needed, and high confidentiality impact. Microsoft has released an official fix for this vulnerability as documented in their security update guide.

An attacker with physical access to a system running the affected Windows 10 Version 1607 can bypass a security feature in the Windows Boot Manager. The confidentiality of the system is impacted, but integrity and availability are not affected. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26175 to remediate this vulnerability.