CVE-2026-61928

Cleartext storage of sensitive information in Windows Hello allows an authorized attacker to perform tampering locally.

Scoring

Severity

MEDIUM

CVSS base score

5.5

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C

EPSS probability

0.21%

CWE

CWE-312

Published

2026-08-11

Last modified

2026-09-16

Affected products

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Microsoft Windows 10 Version 21H2
• Microsoft Windows 10 Version 22H2
• Microsoft Windows 11 version 23H2
• Microsoft Windows 11 Version 23H2
• Microsoft Windows 11 Version 24H2
• Microsoft Windows 11 Version 25H2

Weakness type

• CWE-312

Related vulnerabilities

• CVE-2025-22896 — mySCADA myPRO Manager Cleartext Storage of Sensitive Information
• CVE-2026-22240 — Plaintext Passwords Vulnerability in BLUVOYIX
• CVE-2026-33026 — nginx-ui Backup Restore Allows Tampering with Encrypted Backups
• CVE-2025-7426 — MINOVA TTA Information Disclosure and Credential Exposure
• CVE-2025-34206 — Vasion Print (formerly PrinterLogic) Insecure Shared Storage Permissions
• CVE-2025-23215 — PMD Designer's release key passphrase (GPG) available on Maven Central in cleartext
• CVE-2026-33867 — AVideo has Plaintext Video Password Storage
• CVE-2026-25751 — FUXA Unauthenticated Exposure of Plaintext Database Credentials

Markdown version · Browse all CVEs