Security researchers ran their own code inside a protected part of Windows that is meant to stay sealed off even when the rest of the computer is taken over.

The protected area is a VBS enclave, an isolated slice of memory the operating system uses to guard secrets, and the one they broke into handles passwords for a Windows anti-phishing feature.

The work was done in a lab as a proof of concept, has not been seen in real attacks, and Microsoft fixed the flaw in its September 8, 2026 update.

The flaw is tracked as CVE-2026-83498. Microsoft rates it an elevation-of-privilege issue, Critical, with a CVSS score of 7.8, and says it has not been exploited and was not publicly known before the fix. Microsoft also says it found the same issue internally. The research, by the security firm Doyensec, was published October 13, more than a month after the patch.

A VBS enclave is a signed library that a normal Windows program loads but cannot read or change once it is running. The Windows hypervisor keeps the enclave's memory in a more trusted world, called VTL1 or Isolated User Mode, that ordinary code in the normal world, VTL0, cannot reach, according to Microsoft.

The design is meant to protect what is inside even if an attacker has already taken over the normal kernel or is running as SYSTEM. Running attacker-chosen code inside that world is what makes this research notable.

Source link