Microsoft Patches Two BitLocker Vulnerabilities Allowing Encryption Bypass via Physical Access
Microsoft published fixes on 10 November 2026 for two vulnerabilities in BitLocker, the native disk encryption feature in Windows. The flaws allow an attacker with physical possession of a device to bypass encryption and access stored data. Neither issue had been publicly disclosed or exploited in the wild prior to the patch release.
The first vulnerability, tracked as CVE-2026-119832, received a CVSS score of 5.9 and results from an improperly applied access control. It bypasses encryption on the system storage device where Windows is installed, granting an attacker access to protected data. Exploitation requires physical access and a low-privileged account but needs no action from the device user.
The second issue, CVE-2026-97015, carries a CVSS score of 6.8 and is caused by a buffer overflow in the memory region used for dynamic allocation. It also enables encryption bypass through a physical attack vector, yet requires neither prior privileges nor user interaction. Microsoft rates attack complexity as low but considers successful exploitation less probable.
Affected platforms include Windows 10 versions 1809, 21H2 and 22H2, multiple Windows 11 releases, and Windows Server 2019, 2022 and 2025 editions. Processor platform support varies by version, requiring case-by-case verification. The flaws impact both enterprise and consumer editions.
Because both vulnerabilities depend on physical access, they are not remotely exploitable and therefore unsuitable for mass network attacks. They are, however, precisely relevant to the scenarios BitLocker is designed to protect against, such as lost notebooks, stolen equipment and improperly wiped decommissioned machines.
Patches were distributed as KB5131096 for Windows 10 21H2 and 22H2, KB5131087 for Windows 11 23H2, KB5132059 for Windows 11 26H1, KB5131085 for Windows Server 2019 and KB5131090 for Windows Server 2022. The package addressing CVE-2026-97015 was not listed separately, so administrators should consult the vendor advisory for that identifier.
Related articles
Qlik Sense Servers Targeted with Reverse Shell Attacks in October 2026 Campaign
In October 2026, multiple Qlik Sense servers hosted by European Union customers were subjected to attempted reverse shell installations within a three-minute window. The attacks were blocked before execution and originated from a single-line PowerShell command delivered through the Qlik Sense scheduling component. Analysts noted strong similarities to a November 2023 campaign attributed to CACTUS ransomware operators that exploited three specific vulnerabilities: CVE-2023-41265, CVE-2023-41266, and CVE-2023-48365. The observed activity included a Go-based second-stage payload that searched for Apache ActiveMQ processes, harvested local account hashes on Linux, and deployed modified OpenSSH servers for persistence. Infrastructure recovered during the investigation also contained exploits for a 2023 Apache ActiveMQ vulnerability and a 2024 Veeam Backup and Replication flaw, indicating broader targeting intentions. The root vulnerability exploited in the 2026 attempts remains unidentified.
Ivanti Patches 13 Vulnerabilities in Five Products, Including Two Critical Flaws
Ivanti has issued security updates for five enterprise products to address a total of 13 vulnerabilities, two of which carry a critical severity rating. The affected products include Ivanti Endpoint Manager, Ivanti Cloud Services Application, Ivanti Sentry, Ivanti Endpoint Manager Mobile, and Ivanti User Workspace Manager. The most severe issues allow unauthenticated remote code execution and unauthorized certificate manipulation. One critical flaw, CVE-2026-121653, affects the Core component of Ivanti EPM and scores 9.8 on CVSS v3.0. A second critical vulnerability, CVE-2026-121683, impacts Ivanti CSA version 5.0.8 and enables arbitrary addition or deletion of certificate registration data. The remaining vulnerabilities are rated high and affect multiple other Ivanti solutions.
Google Issues Second Chrome Update This Week, Patching 83 Vulnerabilities Including Five Critical Flaws
Google has released a new security update for its Chrome browser, marking the second release within the same week. The update addresses a total of 83 vulnerabilities across Windows, macOS, and Linux platforms. Five of these issues are rated Critical and involve Use After Free memory errors in key components such as ServiceWorker, CSS, Layout, Skia, and Accessibility. The previous update from November 9 fixed nine vulnerabilities, one of which (CVE-2026-125350) had already been observed in active exploitation. No evidence of in-the-wild exploitation has been reported for the latest set of fixes. The new versions are Chrome 157.0.8103.79 for Windows and macOS and 157.0.8103.78 for all three operating systems.
Mozilla Releases Firefox 160 Fixing 99 Vulnerabilities Including Multiple High-Severity Issues
Mozilla Foundation has published Firefox 160 along with its extended support release, addressing a total of 99 vulnerabilities. Although no Critical-rated flaws were present, 57 vulnerabilities received a High severity rating. Among the notable issues is a Use-After-Free flaw in CanvasWebGL (CVE-2026-124907) that could enable privilege escalation and sandbox bypass. A separate Use-After-Free vulnerability tied to inter-process communication (CVE-2026-124903) also carries the risk of sandbox escape. Additional patches resolve Same-Origin Policy bypasses tracked as CVE-2026-124874 and CVE-2026-124902, along with numerous other security problems across the browser.