CVE-2026-34348

Name of the Vulnerable Software and Affected Versions Windows 11 (affected versions not specified)

Description A protection mechanism failure in the Windows Event Logging Service allows an authorized attacker to disclose sensitive information over a network. Specifically, the system recorded the full passkey authorization response within the WebAuthN/Operational event log (EventID 2106). This information could be read by any local user or remotely by members of the Event Log Readers group. Because Entra ID did not verify if the response had already been used, an attacker could perform a replay attack to gain unauthorized access to another account, bypassing phishing-resistant MFA. Additionally, the issue may allow an attacker to read small portions of heap memory.

Recommendations Install the Windows cumulative updates released on 2026-07-14.