Skip to content
Code Execution Vulnerability in Windows VBS Enclave Disclosed

Code Execution Vulnerability in Windows VBS Enclave Disclosed

First seen 14 Oct 2026, 08:28 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 14, 2026 at 08:29 UTC
  • •Doyensec discovered multiple vulnerabilities in SFAPE.dll, allowing local code execution.
  • •Microsoft patched the vulnerabilities on September 8, 2026, under CVE-2026-83498.
  • •The attack requires local access and has not been observed in real-world exploitation.

Security researchers from Doyensec discovered vulnerabilities in SFAPE.dll, a VBS enclave in Windows, allowing local code execution within Isolated User Mode (VTL1). The vulnerabilities were chained to exploit memory corruption, undermining the enclave's isolation guarantees. Microsoft addressed the issue in its September 8, 2026 update, tracked as CVE-2026-83498, with a CVSS score of 7.8, rated as high severity. The attack requires local access, as it cannot be executed remotely, and has not been seen in real-world attacks. The research was published on October 13, 2026, after the patch was released. Microsoft confirmed the flaw was not publicly known before the fix and had not been.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 1h ago How this analysis works

Timeline

2023-12-07
CVE-2023-36880 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-08
Microsoft patches CVE-2026-83498
Microsoft released an update addressing vulnerabilities in SFAPE.dll, rated as high severity with a CVSS score of 7.8.
Thehackernews
2026-10-13
Doyensec publishes research
Doyensec published findings on vulnerabilities in SFAPE.dll, detailing how they achieved code execution in Isolated User Mode.
Reddit

More articles in this cluster (4)

Following this threat?

Track Akamai and CVE-2023-36880 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 3

Common questions

What systems are affected?
The vulnerability affects Windows systems utilizing the SFAPE.dll VBS enclave for Enhanced Phishing Protection.
Is there an active exploit in the wild?
No, the vulnerabilities have not been observed in real-world exploitation according to Microsoft.
What should organizations do?
Organizations should ensure they have applied the September 8, 2026 update to mitigate the vulnerabilities.