CVE-2026-72980: CWE-427: Uncontrolled Search Path Element in Microsoft Windows 10 Version 1607

This vulnerability, identified as CWE-427, concerns an uncontrolled search path element in Windows Hello on Windows 10 Version 1607. An authorized attacker with high privileges can exploit this flaw locally to bypass a security feature, potentially leading to unauthorized access to sensitive information. The CVSS 3.1 base score is 4.4, reflecting a medium severity with local attack vector, low complexity, and no user interaction required. The vulnerability affects multiple Windows 10 builds starting from 10.0.14393.0 up to various fixed versions below 10.0.14393.9512 and others as specified. Microsoft has issued an official fix to address this vulnerability.

An authorized local attacker with high privileges can bypass a security feature in Windows Hello, potentially compromising confidentiality. There is no impact on integrity or availability. No known exploits are reported in the wild.

An official fix from Microsoft is available and should be applied to affected Windows 10 versions. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72980 for update details and installation instructions.