PT-2026-32790 · Microsoft · Windows Server 2016+1

CVE-2026-27928 · Published 2026-04-14 · Updated 2026-04-15

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server 2016 versions 10.0.14393.0 through 10.0.14393.9059

Description Improper input validation in Windows Hello allows an unauthorized attacker to bypass a security feature over a network by sending malformed input, enabling unauthorized access to protected functionality.

Recommendations Update Microsoft Windows Server 2016 to version 10.0.14393.9060 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2026-05335

CVE-2026-27928

Affected Products

Windows

Windows Server 2016

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-27928 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27928 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27928 · Security Note
• https://bdu.fstec.ru/vul/2026-05335 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-27928 · Vendor Advisory
• https://twitter.com/RedHornet_Intel/status/2044118187608797447 · Twitter Post
• https://twitter.com/CVEnew/status/2044358599552454887 · Twitter Post
• https://twitter.com/vuldb/status/2044115776203084061 · Twitter Post