Windows BitLocker security feature bypass
Publicly disclosed BitLocker Device Encryption bypass fixed in Microsoft's July 2026 Patch Tuesday. Requires physical access; no confirmed exploitation as of publication.
- Vendor
- Microsoft
- Product
- Windows (BitLocker Device Encryption) — see MSRC advisory for affected builds
- CVSS
- 6.1
- EPSS (exploit probability)
- 0.5%
- Status
- patched
- Published
Is CVE-2026-50661 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-50661 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-19 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.5% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-19. Full cross-catalog view: /kev-comparison
CVE-2026-50661 is a security feature bypass in Windows BitLocker. Per Microsoft’s advisory, a successful attacker can bypass BitLocker Device Encryption on the system storage device. NVD scores it 6.1 (medium). Microsoft rates it Important.
Microsoft disclosed the flaw in the July 2026 Patch Tuesday release on 2026-07-14. The vulnerability was publicly disclosed prior to patch availability but has not been confirmed as exploited in the wild at time of publication. Exploitation requires physical access to the target device.
Practical impact is highest for organisations that handle lost/stolen laptop recovery or that ship devices through third-party logistics chains where physical access is difficult to guarantee. Standard Patch Tuesday rollout channels are sufficient for most fleets.
See the write-up: Microsoft July Patch Tuesday: 570 CVEs, 3 zero-days out.
Other Microsoft CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-96951 Microsoft Windows Command Injection Vulnerability | [ HIGH ] | 8.8 | 1.5% | |
| CVE-2026-96940 Microsoft Exchange Server privilege escalation via weak authorizationwrite-up | [ HIGH ] | 8.8 | 0.5% | — |
| CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerabilitywrite-up | [ HIGH ] | 8.8 | 2.1% | |
| CVE-2026-85889 Azure AI Foundry missing authentication allows unauthorized privilege escalationwrite-up | [ CRITICAL ] | 10.0 | 0.7% | — |
| CVE-2026-69843 Microsoft Fabric authentication bypass by spoofingwrite-up | [ CRITICAL ] | 10.0 | 0.9% | — |
| CVE-2026-85880 Microsoft Windows ALPC Heap Buffer Overflow Privilege Escalationwrite-up | [ HIGH ] | 7.8 | 3.6% | |
| CVE-2026-81963 Microsoft Windows Update Stack Link-Following Privilege Escalationwrite-up | [ HIGH ] | 7.8 | 0.4% | |
| CVE-2026-62916 Authentication Bypass via Alternate Path in Microsoft Entra IDwrite-up | [ CRITICAL ] | 9.1 | 0.9% | — |
