CVE-2026-20928
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
Improper removal of sensitive information before storage or transfer in Windows Recovery Environment Agent allows an unauthorized attacker to bypass a security feature with a physical attack.
Risk Assessment
A person with physical access to the device can bypass protections and access sensitive information. The risk mainly affects unattended devices.
Recommendation
Apply Microsoft security updates for Windows Recovery Environment Agent. Restrict physical access to devices and implement protections against unauthorized physical access.
Other vulnerabilities in Windows Recovery Environment Agent
Original NVD description (English source)
Improper removal of sensitive information before storage or transfer in Windows Recovery Environment Agent allows an unauthorized attacker to bypass a security feature with a physical attack.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS