Windows Hello Uncontrolled Search Path Element

Publication date: 2026-09-08

Last updated on: 2026-09-10

Assigner: Microsoft Corporation

Description

Uncontrolled search path element in Windows Hello allows an authorized attacker to bypass a security feature locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-10

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-72980

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	windows_hello	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-427	The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

Attack-Flow Graph

Executive Summary

This vulnerability is an uncontrolled search path element in Windows Hello. It allows an authorized attacker to bypass a security feature locally by manipulating the search path for executable files.

Impact Analysis

An authorized attacker could exploit this to bypass security features on your system, potentially gaining unauthorized access or executing malicious code locally.

Mitigation Strategies

Apply the latest security updates from Microsoft for Windows Hello to address the uncontrolled search path element issue.

Hi! I’m here to help you understand CVE-2026-72980. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70