Back learn.microsoft.com

Vbs Enclaves

learn.microsoft.com • October 14, 2026

Access to this page requires authorization. You can try signing in or changing directories .

Access to this page requires authorization. You can try changing directories .

Applies to: ✅ Windows 11 Build 26100.2314 or later ✅ Windows Server 2025 or later

A Virtualization-based security (VBS) Enclave is a software-based trusted execution environment inside the address space of a host application. VBS Enclaves leverage underlying VBS technology to isolate the sensitive portion of an application in a secure partition of memory. VBS Enclaves enable isolation of sensitive workloads from both the host application and the rest of the system.

The following are required to run VBS Enclaves:

VBS/HVCI must be enabled. This should be enabled on Windows 11 or later by default. See Enable virtualization-based protection of code integrity for more information.

Windows 11 Build 26100.2314 or later or Windows Server 2025 or later.

Ensure you have reviewed the OS support for VBS enclaves above, as support has recently changed.

Development prerequisites

In addition to the device requirements, the following are required to develop VBS Enclaves:

Visual Studio 2022 version 17.9 or later - The Microsoft Visual C++ compiler (MSVC) is required. Installing Visual Studio simplifies this.

The Windows Software Development Kit (SDK) version 10.0.22621.3233 or later, which provides veiid.exe (the VBS Enclave import ID binding utility) and signtool.exe .

A Trusted Signing account.

Development resources

The following tools, information, and samples are available to help you develop VBS Enclaves:

APIs available in VBS enclaves

Securing your sensitive workloads with VBS Enclaves

Secure Enclaves (Trusted Execution) overview

Always Encrypted with secure enclaves documentation

Virtualization-based Security (VBS) | Windows Hardware Developer

New Windows 11 features strengthen security to address evolving cyberthreat landscape

Was this page helpful?

Need help with this topic?

Want to try using Ask Learn to clarify or guide you through this topic?

Last updated on 2026-03-04

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Code Execution Vulnerability in Windows VBS Enclave Disclosed Security researchers from Doyensec discovered vulnerabilities in SFAPE.dll, a VBS enclave in Windows, allowing local code execution within Isolated User Mode (VTL1). The vulnerabilities were chained to exploit memory corruption, undermining the enclave's isolation guarantees. Microsoft addressed the issue in its September 8, 2026 update, tracked as CVE-2026-83498, with a CVSS score of 7.8, rated as high severity. The attack requires local access, as it cannot be executed remotely, and has not been seen in real-world attacks. The research was published on October 13, 2026, after the patch was released. Microsoft confirmed the flaw was not publicly known before the fix and had not been. 3 sources 46

Vbs Enclaves

The full story

Extracted Entities

Platforms (2)

Tools (2)