CVE-2026-32220

What it actually does

This is a local security feature bypass in Windows Virtualization-Based Security (VBS) Enclave access controls. An already-authorized local attacker with high privileges can abuse improper access control to bypass protections that are intended to preserve enclave isolation or integrity. The impact is limited to integrity: the flaw does not directly provide remote code execution, initial access, data disclosure, or denial of service, but it can weaken a defense boundary that protected code or secrets may rely on.

Why it matters to the business

The main business risk is that an attacker who already has significant local control over a Windows endpoint or server may be able to bypass a platform security protection that applications or security controls depend on. This can make post-compromise activity harder to contain and may reduce confidence in workloads that rely on VBS-backed isolation. Current public exploitation indicators are low: EPSS is approximately 0.29%, the score has been flat over 30 days, it is not listed in CISA KEV, and no public exploit maturity is reported. Affected platforms include Windows 11 24H2, 25H2, 26H1, and Windows Server 2025.

How an attack unfolds

Exploitation requires local access and high privileges, so this flaw is most relevant after an attacker has already compromised a system or obtained administrative-level execution. The attacker would run code locally on an affected Windows build and interact with VBS Enclave-related interfaces or protected components in a way that abuses the improper access control. If successful, the attacker bypasses the intended security feature and can modify or influence protected execution or trust assumptions that should have been enforced by the enclave boundary. This vulnerability is therefore best treated as a post-exploitation hardening bypass rather than an initial compromise vector.

How to fix it

Apply the applicable Microsoft security update or latest cumulative update for affected systems as soon as it is available through Windows Update, Microsoft Update Catalog, WSUS, Intune, or other enterprise patch management tooling. Because no exact fixed build numbers were provided in the input, validate remediation against Microsoft’s official security update guidance for Windows 11 24H2, Windows 11 25H2, Windows 11 26H1, and Windows Server 2025. There is no reliable configuration-only mitigation that should be considered equivalent to patching. As compensating controls, restrict local administrator access, enforce credential hygiene, use application control where feasible, monitor privileged process execution, and maintain VBS/HVCI protections rather than disabling them.

How to confirm the fix worked

Confirm that affected Windows 11 and Windows Server 2025 systems have installed the relevant Microsoft cumulative security update that addresses this issue. Validate operating system build and installed hotfix history using enterprise patch inventory, Windows Update compliance reports, or local commands such as `winver`, `systeminfo`, `Get-ComputerInfo`, `Get-HotFix`, and update management telemetry. Confirm that VBS-related security features remain enabled where required by policy by reviewing Windows Security, Group Policy, MDM configuration, or `msinfo32` virtualization-based security status. Exposure remains if the host is on an affected product version and has not received the applicable security update.

Typical attack path

1. Gain initial access to an affected Windows 11 or Windows Server 2025 system through another vulnerability, stolen credentials, malware, or hands-on-keyboard access.
2. Escalate to or obtain high local privileges on the target host.
3. Determine that VBS, virtualization-based security features, or enclave-dependent workloads are present and relevant.
4. Execute local tooling or custom code that interacts with VBS Enclave functionality and triggers the improper access control condition.
5. Bypass the intended security feature to alter protected integrity assumptions, weaken platform isolation, or enable follow-on tampering activity.
6. Continue post-compromise objectives while relying on the bypass to evade or undermine protections that would otherwise constrain the attacker.

How to detect it

There are no public, CVE-specific indicators or widely reported exploitation artifacts for this issue based on the provided data. Detection should focus on prerequisite and follow-on behavior: evidence of local administrator compromise, unusual privileged process execution, attempts to disable or weaken VBS/HVCI/Credential Guard, unexpected changes to Device Guard or virtualization-based security policy, suspicious driver loading, and abnormal security feature configuration changes. Useful log sources include Windows Security logs, Microsoft Defender for Endpoint telemetry, Sysmon if deployed, Windows Code Integrity and Device Guard event logs, PowerShell logs, process creation telemetry, driver load events, and endpoint configuration compliance records. Review for privileged command execution around the time of suspected compromise, especially tools or scripts querying or modifying VBS status, registry keys under DeviceGuard/LSA policy areas, or boot configuration settings related to hypervisor and integrity protections.

• bcdedit /set hypervisorlaunchtype off
• bcdedit /set vsmlaunchtype off
• bcdedit /set nointegritychecks on
• bcdedit /set testsigning on
• reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard
• reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LsaCfgFlags
• Set-ProcessMitigation
• Get-CimInstance Win32_DeviceGuard
• Win32_DeviceGuard
• HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard
• HKLM\SYSTEM\CurrentControlSet\Control\Lsa\LsaCfgFlags
• Microsoft-Windows-CodeIntegrity/Operational
• Microsoft-Windows-DeviceGuard/Operational

What your security team should do

• Prioritize patching affected Windows Server 2025 systems and high-value Windows 11 endpoints used by administrators, developers, security teams, or sensitive workloads.
• Do not treat this as an internet-facing emergency by itself; focus urgency on systems where an attacker gaining local high privileges would materially increase business risk.
• Review and reduce membership in local Administrators and other high-privilege groups across affected systems.
• Hunt for signs of prior host compromise, because exploitation requires the attacker to already have high local privileges.
• Ensure VBS, HVCI, Secure Boot, Credential Guard, and related platform protections are consistently configured and not disabled outside approved exceptions.
• Add detection coverage for suspicious privileged local execution, unsigned driver loading, tampering with virtualization-based security settings, and abnormal access to enclave or security-sensitive processes.
• Track Microsoft advisories for exact fixed build numbers if not already available in internal patch tooling.