[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6LaoO9MioRARKoPQD4nkMoOD6Wx5MnKC-mN_HiqQ_J8":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"1cbad1d6-e575-4154-a3da-301d3debfbd5","bitlocker-bypasses-highlight-the-risk-of-unpatched-encryption-controls","c94a33b5-8fff-4ee5-98ee-8e0a3a25b602","BitLocker Bypasses Highlight the Risk of Unpatched Encryption Controls","Two newly disclosed BitLocker vulnerabilities expose a critical gap: encryption at rest provides little protection when the underlying platform software can be bypassed. CVE-2026-119832 is particularly alarming because it requires only physical access and basic user privileges to defeat BitLocker Device Encryption — a scenario common in lost or stolen laptops. CVE-2026-97015 compounds the risk with a heap-based buffer overflow that requires no privileges or user interaction, widening the attack surface. These flaws matter because organisations often treat BitLocker as a final safety net for endpoint data protection, yet that net fails completely if patches are not applied promptly. Microsoft has released KB updates, making timely patch deployment the single most effective control available right now.","**Immediate actions:**\n- Apply all Microsoft KB updates addressing CVE-2026-97015 and CVE-2026-119832 to every supported Windows version in your environment.\n- Prioritise patching endpoints that are mobile, field-deployed, or otherwise at risk of physical access by unauthorised individuals.\n\n**Long-term improvements:**\n- Enforce an automated patch management policy with defined SLAs (e.g., 72 hours for Important-rated OS vulnerabilities) to reduce the window between disclosure and remediation.\n- Maintain a continuously updated hardware and OS inventory so patch coverage can be verified against every endpoint, not just those under active management.\n- Layer additional controls (pre-boot PIN, TPM+PIN authentication, MFA for disk unlock) so that BitLocker is not the sole protection against physical-access attacks.\n\n**Detection measures:**\n- Monitor endpoint telemetry and BitLocker event logs for unexpected decryption or policy changes that may signal exploitation attempts.\n- Alert on any device that reports BitLocker as disabled or in a suspended state outside of an approved maintenance window.",[12,13,14,15,16],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 2: Inventory and Control of Software Assets (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SC-28: Protection of Information at Rest","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":18,"NIST SP 800-53 SI-2: Flaw Remediation":19,"CIS Control 7: Continuous Vulnerability Management (v8)":20,"NIST SP 800-53 SC-28: Protection of Information at Rest":21,"CIS Control 2: Inventory and Control of Software Assets (v8)":22},"This point requires security in acquisition, development, and maintenance including vulnerability handling, meaning operators must have processes to respond to disclosed flaws like these BitLocker CVEs within their maintenance lifecycle.","SI-2 requires organisations to identify, report, and correct information system flaws within defined time frames, which is the core action needed to close these BitLocker vulnerabilities.","This control requires organisations to establish a process for identifying, prioritising, and remediating vulnerabilities — directly addressing the need to patch CVE-2026-97015 and CVE-2026-119832 before attackers can exploit them.","SC-28 mandates that encryption protecting data at rest remains effective; a vulnerability that bypasses BitLocker directly undermines this control's intent.","Knowing exactly which Windows versions are deployed across endpoints is a prerequisite for verifying that every affected system has received the BitLocker KB updates.","published","2026-11-11T12:21:00.672309+00:00","2026-11-11T12:21:00.649+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fcybersecuritynews.com\u002Fwindows-bitlocker-security-bypass\u002F","windows-bitlocker-vulnerabilities-allow-attackers-to-bypass-security-feature-dcf611","Windows BitLocker Vulnerabilities Allow Attackers to Bypass Security Feature",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[45,48,52],{"slug":40,"name":46,"problem":47},"Automated patch management","Known holes get closed in days, not months.",{"slug":49,"name":50,"problem":51},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":53,"name":54,"problem":55},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control."]