CVE-2026-83498

Think of this like a locked back office in your store that's supposed to only open with a special key — this flaw lets someone who already has a basic employee badge trick the lock into opening fully, giving them access to everything in the building, not just the back office. They don't need to fool you into clicking anything; they just need some existing access to the computer first.

This matters to you if you run Windows 11 or Windows Server 2025 on any computers or servers in your business. It only becomes a real risk if someone with some level of access to the machine — such as a rogue employee, a shared-computer user, or malware that already got a foothold — is present on that device.

Security researchers have already studied and published analysis of this flaw as part of a public roundup, and it allows a full takeover of the machine with no user interaction once an attacker has basic access — Microsoft has not confirmed any real-world attacks yet, but the severity and attention this received means it should be treated as a priority to patch now rather than wait.

Verify affected systems by checking the installed Windows build number against the vendor's fixed builds. Fixed versions: Windows 11 → 10.0.22631.7582, 10.0.26100.9445, 10.0.26200.9445, or 10.0.28000.2954 depending on edition/branch; Windows Server 2025 → 10.0.26100.33438. Deploy via standard Windows Update / WSUS / patch management and reboot to complete remediation. No clean workaround exists for an untrusted pointer dereference in the VBS enclave beyond restricting local login/admin rights on sensitive machines as a temporary mitigation while patches are staged. There is no CISA KEV listing and no confirmed exploitation, so this is not currently on a forced remediation deadline, but given the local-privilege-escalation-to-full-control impact and sustained research attention (Qualys roundup coverage), prioritize this in the current patch cycle. Monitor vendor advisories and KEV listings for status changes, and watch for any follow-up exploit code release given the public research interest.

CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), CWE-822 (Untrusted Pointer Dereference) in the Windows VBS Enclave. Exploitation requires local access with low privileges and no user interaction; no privilege escalation beyond that is needed for full system compromise (confidentiality, integrity, and availability all rated High). Not listed in CISA KEV; no confirmed in-the-wild exploitation per Microsoft or press reporting. EPSS places this in the lower range of predicted exploitation likelihood with a flat trend. No public exploit code is known to exist; press attention is sustained due to a research roundup (Qualys) rather than active attack reporting. Exploit maturity: proof-of-concept research exists per vendor statements, but not weaponized or observed in attacks.