CVE-2026-20804: 
vulnerability analysis and mitigation

CVE-2026-20804 is an incorrect privilege assignment vulnerability in Windows Hello that allows an unauthorized local attacker to perform tampering on affected systems. Disclosed by Microsoft on January 13, 2026, as part of the January 2026 Patch Tuesday, it affects a wide range of Windows versions including Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2), Windows Server 2016, 2019, 2022, 2022 23H2, and Windows Server 2025. It carries a CVSS v3.1 base score of 7.7 (High) (Microsoft MSRC, Feedly).

The vulnerability is classified as CWE-266 (Incorrect Privilege Assignment), meaning Windows Hello's privilege controls are improperly implemented, allowing a local attacker without credentials to interact with authentication components at an elevated privilege level. An attacker with local access to the system can exploit this flaw to tamper with Windows Hello biometric authentication data and settings without requiring user interaction or elevated privileges. The attack vector is local (AV:L), with low complexity (AC:L) and no privileges required (PR:N), making it straightforward to exploit once physical or logical local access is obtained (Microsoft MSRC, Feedly).

Successful exploitation can result in high confidentiality and integrity impacts, as an attacker could read sensitive authentication data and modify Windows Hello biometric authentication settings without valid credentials. This could allow an attacker to bypass or alter biometric authentication controls, potentially enabling unauthorized access to the affected system. Availability is not impacted, and the scope is unchanged, meaning the impact is confined to the compromised host (Microsoft MSRC, Feedly).

Microsoft released security updates on January 13, 2026, addressing this vulnerability across all affected platforms. Organizations should update to the following minimum build versions: Windows 10 1607/Server 2016 (10.0.14393.8783), Windows 10 1809/Server 2019 (10.0.17763.8276), Windows 10 21H2 (10.0.19044.6809), Windows 10 22H2 (10.0.19045.6809), Windows 11 23H2 (10.0.22631.6491), Windows 11 24H2 (10.0.26100.7623), Windows 11 25H2 (10.0.26200.7623), Windows Server 2022 (10.0.20348.4648), Windows Server 2022 23H2 (10.0.25398.2092), and Windows Server 2025 (10.0.26100.32230). As an interim measure, organizations should restrict local access to systems to authorized users only and monitor for unauthorized changes to authentication configuration (Microsoft MSRC, Feedly).

The vulnerability was covered as part of broader January 2026 Patch Tuesday reporting, with security outlets such as BleepingComputer, Cyber Security News, and GBHackers noting it among the 114 flaws patched that month (BleepingComputer, Cyber Security News). Zero Day Initiative also reviewed the January 2026 update batch, though CVE-2026-20804 was not highlighted as a critical priority compared to the three zero-days patched in the same release (ZDI Blog). A follow-up report in February 2026 noted that Microsoft blocked credential autofill as a related mitigation measure for Windows Hello on Windows 11 24H2 and 25H2 (Winbuzzer).