Windows VBS enclave CVE-2026-83498 (CVSS 7.8 Critical): Doyensec showed local code execution inside SmartScreen Enhanced Phishing Protection (SFAPE.dll); fixed in 8 Sep cumulative update, research published 13 Oct

Doyensec published Playing It SFAPE on 13 October 2026 describing a local elevation-of-privilege chain against the Windows Virtualization-Based Security (VBS) enclave behind Microsoft Defender SmartScreen Enhanced Phishing Protection (SFAPE.dll). The enclave stores a hashed form of the Windows sign-in password so SmartScreen can warn when that password is typed or pasted into an unsafe place; it runs in Isolated User Mode (VTL1), which ordinary kernel code in VTL0 cannot read. Researchers showed that calling the enclave's Initialize function a second time writes a fixed four-byte error value to a caller-controlled address (skipping an address check used on the first call), then combined that with a timing bug to run attacker-chosen code inside the enclave. Microsoft rates CVE-2026-83498 Critical, CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), impact elevation of privilege / untrusted pointer dereference (CWE-822), and says successful exploitation could leak data from the enclave or execute code in its context. The attack is local (needs a process that already loads and calls the enclave, typically LSASS for SFAPE), was not publicly known or exploited before the fix, and Microsoft also found the issue internally. The fix shipped in the 8 September 2026 cumulative update (Doyensec cites KB5124008 for Windows 11 24H2/25H2; MSRC lists updates across Windows 11 23H2–26H1 and Windows Server 2025) and includes a policy that blocks loading the old vulnerable SFAPE.dll. Doyensec notes Windows still lacks a general vulnerable-enclave blocklist, and an older signed Edge enclave (CVE-2023-36880) remains loadable. Wire: The Hacker News (14 Oct). Primary: Doyensec research post and Microsoft MSRC advisory.

Product

Microsoft Defender SmartScreen Enhanced Phishing Protection (SFAPE.dll VBS enclave) on Windows 11 / Windows Server 2025

Versions

Fixed in 8 September 2026 cumulative updates per MSRC (Windows 11 23H2, 24H2, 25H2, 26H1 and Windows Server 2025 builds listed on the advisory). Doyensec compared SFAPE.dll 10.0.26100.8875 (vulnerable) with 10.0.26100.9444 in KB5124008.

CVSS

7.8 (Microsoft, CVSS 3.1 Critical)

Exploited in Australia?

unknown

Patch to

Install the September 2026 Windows cumulative update that includes CVE-2026-83498 for your SKU (see MSRC). There is no separate workaround; the update also blocks the old SFAPE enclave from loading. Treat this as defence-in-depth for hosts that already apply monthly Windows updates.

Primary: Doyensec — Playing It SFAPE: Code Execution in Isolated User Mode (13 Oct 2026) · Vendor: Microsoft MSRC — CVE-2026-83498 Windows VBS Enclave Elevation of Privilege (released 8 Sep 2026) · CVE: CVE-2026-83498, CVE-2023-36880 · The Hacker News — Four-byte write and timing bug let researchers run code in Windows SmartScreen enclave (14 Oct 2026)

vulnerabilities identity