CVE-2026-50661

BitLocker is Windows’ built-in way to protect your data on a disk by encrypting it. This issue is a weakness where someone who can get hands-on with the device can bypass BitLocker’s protection without needing a password or user actions, which means the stored data may be easier to access.

This matters if you use or manage Windows 10, Windows 11, or Windows Server 2016/2019/2022/2025 systems with BitLocker-enabled drives. The risk is specifically for situations where an attacker can get physical access to the device (for example, an unattended laptop or a server you can’t fully control). There’s no login needed and no clicks required, so treat physical access as the gate: it’s a risk when the device is reachable in person by an attacker.

Verdict is RED because this is a security-feature bypass that works with physical access and requires no authentication or user interaction. Even though public exploit details and KEV listing aren’t provided here, the practical scenario (someone having hands-on access) can be real for small businesses, making fast patching important.

1. Confirm exposure (which machines):
   • For each workstation/server, confirm the OS family is one of: Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025.
2. Confirm whether you are on an affected build:
   • Record the exact Windows version/build number using winver.
   • Compare against the fixed build list below and verify your build is at or above the fixed version for your OS line.
3. Patch to the fixed versions (use the list exactly):
   • Windows 10: fixed in 10.0.14393.9339 OR 10.0.17763.9020 OR 10.0.19044.7548 OR 10.0.19045.7548.
   • Windows 11: fixed in 10.0.26100.8875 OR 10.0.26200.8875 OR 10.0.28000.2525.
   • Windows Server 2016: fixed in 10.0.14393.9339.
   • Windows Server 2019: fixed in 10.0.17763.9020.
   • Windows Server 2022: fixed in 10.0.20348.5386.
   • Windows Server 2025: fixed in 10.0.26100.33158.
   • Microsoft guidance page: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50661.
4. If patching must be delayed (temporary risk reduction):
   • Reduce the chance of physical access: keep devices in locked rooms, use cable locks where appropriate, supervise devices in transit, and avoid leaving laptops/servers unattended.
   • Ensure staff know devices must not be left in public areas where someone can touch them.
5. What to monitor after patching:
   • Confirm Windows Update reports the security update as installed.
   • Verify your BitLocker status remains enabled and system behavior is unchanged (monitor for any unexpected recovery/boot behavior, though no specific post-exploitation artifacts are provided in the findings).

Note on exploitation status:

• KEV is not listed in the provided findings, and no clear dated exploitation claim or public exploit code is provided here; treat this as a newly emphasized patch (press attention) and prioritize mitigation based on the physical-access nature of the weakness.

Severity context: CVSS 6.1 (Medium) but the real-world scenario is high impact because BitLocker is meant to protect data at rest and this is described as bypassing that protection. Weakness: CWE-693 (security bypass). Attack vector and prerequisites: local/physical attack requiring physical access; authentication required: none; user interaction: none. Reachability: the findings state risk depends on physical access to the device, while “reachable in default config” is unknown.
Exploitation/exploit maturity: no public exploit code is on record; no KEV listing provided; no clear dated press claim of exploitation in the findings. Patch status: fixed versions are listed across Windows 10/11 and Windows Server 2016/2019/2022/2025, indicating Microsoft has addressed the issue.
What KEV means here: KEV would indicate known exploited vulnerability; it is not listed for this CVE in the findings, so confirmed widespread exploitation through KEV is not established here.