Doyensec researchers breached a Windows VBS enclave tied to Microsoft Defender SmartScreen’s Enhanced Phishing Protection (CVE-2026-83498).
The flaw required local access and was fixed for Windows 11 24H2 and 25H2 in update KB5124008, which blocks the vulnerable SFAPE.dll from loading.
Researchers also highlight the lack of a central blocklist for vulnerable enclaves.
How did the problem work?
The Doyensec research team identified loopholes in the way Microsoft's software manages this isolated space. Although the enclave is designed to remain closed and inaccessible even to other computer functions, the researchers were able to trick the protection mechanisms and execute their own commands in this environment.
It is important to note that this attack cannot be carried out remotely. For it to work, an attacker must already have access to the victim's computer. Microsoft has rated the issue as critical, as it concerns the security of user data.
What is true today?
There is no evidence that this vulnerability was used in real-world attacks before it was discovered by researchers. Microsoft released an update on September 8, 2026 that fixes the issue for Windows 11 (versions 24H2 and 25H2) users.
This update introduces a new rule that blocks the specific problematic software file that enabled the attack from loading. However, the researchers pointed out that a broader issue remains with Windows: the lack of a central list that would automatically exclude older, vulnerable pieces of software, which leaves room for similar problems in the future.
Top comments (0)