#VU126164 Improper Removal of Sensitive Information Before Storage or Transfer in Windows and Windows Server - CVE-2026-20928

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU126164

#VU126164 Improper Removal of Sensitive Information Before Storage or Transfer in Windows and Windows Server - CVE-2026-20928

Published: April 15, 2026


Vulnerability identifier: #VU126164
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-20928
CWE-ID: CWE-212
Exploitation vector: Local access
Exploit availability: No public exploit available
Vulnerable software:
Windows
Windows Server
Software vendor:
Microsoft

Description

The vulnerability allows a local attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper removal of sensitive information before storage or transfer in Windows Recovery Environment. An attacker with physical access can bypass the BitLocker Device Encryption feature on the system storage device, leading to information disclosure.


Remediation

Install updates from vendor's website.

External links