Windows BitLocker: Security feature bypass via physical access

Summary

A flaw in Microsoft's BitLocker drive encryption allows a bypass of its security feature. An attacker with physical access to the device and a low-privilege account can get past BitLocker Device Encryption on the system drive, which can expose encrypted data. No user interaction and no network access are required, but the attack depends on physical access to the device.

Affected

• Windows 10 Version 1809 (10.0.17763.0 to before 10.0.17763.9487)
• Windows 10 Version 21H2 (10.0.19044.0 to before 10.0.19044.7846)
• Windows 10 Version 22H2 (10.0.19045.0 to before 10.0.19045.7846)
• Windows 11 Version 23H2 (10.0.22631.0 to before 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 to before 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 to before 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 to before 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 to before 10.0.26300.9974)
• Windows Server 2019 and Server Core installation (10.0.17763.0 to before 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 to before 10.0.20348.5870)
• Windows Server 2025 and Server Core installation (10.0.26100.0 to before 10.0.26100.33822)

Fixed in

• Fixed in the November 10, 2026 cumulative updates.
• Windows 10 1809 and Windows Server 2019: 10.0.17763.9487 or later
• Windows 10 21H2: 10.0.19044.7846 or later
• Windows 10 22H2: 10.0.19045.7846 or later
• Windows 11 23H2: 10.0.22631.7711 or later
• Windows 11 24H2 and 25H2, Windows Server 2025: 10.0.26100.9974 or 10.0.26100.33822 or later, as listed for each branch
• Windows 11 26H1: 10.0.28000.3501 or later
• Windows Server 2022: 10.0.20348.5870 or later
• Knowledge base numbers reported by press (verify in the MSRC guide before deployment): KB5131096 (Windows 10 21H2/22H2), KB5131087 (Windows 11 23H2), KB5132059 (Windows 11 26H1)

Workaround

Unknown.

• No workaround or mitigation was found in the sources reviewed.
• Physical access is the precondition, so controlling access to endpoints reduces the risk.

Exploitation

• Microsoft rates exploitation as less likely.
• The CVE is not publicly disclosed, and no public proof of concept was found.
• No confirmed in-the-wild exploitation is known. CISA SSVC lists exploitation as none and automatable as no.
• Microsoft credits researcher yhw.

Our recommendation

• Install the November 2026 security updates on all affected Windows 10, 11 and Server systems in the normal patch cycle, and prioritise laptops and other mobile devices.
• Confirm that BitLocker is enabled and correctly configured after patching.
• Enforce a BitLocker PIN or other pre-boot authentication where practical, and protect lost or unattended devices.
• Recheck CISA KEV and public exploit sources, as this is a new CVE.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-119832 msrc.microsoft.com
• CVE Record CVE-2026-119832 www.cve.org
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• Cryptika: Windows BitLocker vulnerabilities www.cryptika.com
• Cybersecurity News: Windows BitLocker security bypass cybersecuritynews.com
• Senserva: KB5131087 senserva.com
• Senserva: KB5132059 senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 15:16.