BitLocker bypass flaws: Cyber Security News reports Microsoft disclosure

What happened

According to Cyber Security News, Microsoft has disclosed two Windows BitLocker security feature bypass vulnerabilities that could let attackers with physical access weaken device protections. The outlet says they were published on November 10, 2026, and are tracked as CVE-2026-97015 and CVE-2026-119832. Cyber Security News reports that Microsoft rates both as Important, with CVSS base scores of 6.8 and 5.9 respectively. We have only this one outlet’s account. Microsoft’s own advisory was not among our sources, so the details below are as relayed by Cyber Security News.

Details reported by Cyber Security News:

• CVE-2026-97015: the outlet says it stems from a heap-based buffer overflow (CWE-122). Microsoft says an unauthorized attacker could bypass a security feature through a physical attack, with no existing privileges or user interaction and low attack complexity.
• CVE-2026-119832: the outlet says it involves improper access control. It reports that Microsoft confirms a successful attacker could bypass BitLocker Device Encryption on the system storage device and access encrypted data. The attack needs physical access and low privileges, and no user interaction.
• Status at release, CVE-2026-119832 only: the outlet says that, according to Microsoft’s advisory, the vulnerability was not publicly disclosed or known to be exploited at release. It also says Microsoft rates exploitation as less likely and credits researcher yhw. The article does not state clearly whether this applies to CVE-2026-97015, so that is not confirmed.

Not confirmed in the sources: any real-world exploitation of either flaw, the technical details of the bypasses, the exploitation status and researcher credit for CVE-2026-97015, and the list of updates for CVE-2026-97015.

Am I affected?

Per Cyber Security News:

• CVE-2026-119832 affects Windows 10 versions 1809, 21H2 and 22H2, several Windows 11 releases, and Windows Server 2019, 2022 and 2025. Supported processor platforms vary by release.
• CVE-2026-97015 has a broader affected product list that also includes older Windows Server branches.
• The two records have different device lists, so check each one rather than assume a shared list.

The outlet describes both attacks as requiring physical access to the device. The exact build coverage beyond the above is not confirmed here.

What to do now

1. Open Microsoft’s advisory records for CVE-2026-97015 and CVE-2026-119832 and compare the affected products against your inventory.
2. For CVE-2026-119832, the outlet lists these updates: KB5131096 (Windows 10 21H2 and 22H2), KB5131087 (Windows 11 23H2), KB5132059 (Windows 11 26H1), KB5131085 (Server 2019) and KB5131090 (Server 2022). Confirm the correct update for other builds in Microsoft’s record.
3. For CVE-2026-97015, look up the fixing update directly in Microsoft’s record, since the source does not list one.
4. Track the two CVEs separately, as the source says they have different causes and access requirements.

Sources

• Cyber Security News: Windows BitLocker Vulnerabilities Allow Attackers to Bypass Security Feature