Someone got code running inside the sealed room Windows keeps your password in

Windows 11 keeps a handful of secrets in what amounts to a sealed room. It is called a VBS enclave, a slice of memory walled off by the processor so that even malware running with full administrator rights on the machine cannot read what is inside. One of those enclaves holds the hashed copy of your Windows password that Defender SmartScreen uses for Enhanced Phishing Protection, the feature that speaks up if you type that password into a web page or paste it into Notepad.

On 13 October, Adrian Denkiewicz of the security firm Doyensec published the full story of getting his own code running inside it. The component is called SFAPE.dll, and the way in was almost comically small: calling its initialisation routine twice let him write four fixed bytes to an address of his choosing. From that single foothold he built memory reads, then writes, then broke the enclave's own validation table and ended up calling arbitrary functions inside the protected area. The enclave is loaded by lsass.exe, which runs as SYSTEM, so the prize was real.

Now the reassuring part. The flaw, CVE-2026-83498, was fixed on 8 September in KB5124008. Microsoft also changed the code integrity policy so Windows refuses to load older vulnerable copies of the file, closing the obvious trick of rolling it back. Nobody has seen this used in an actual attack, and it is not something that reaches you from the internet. An attacker needs code already running on your PC before any of it applies.

Which is the whole point. Research like this only becomes dangerous on machines that stopped taking updates months ago. Tendvane's health score flags a PC that has quietly fallen behind, which is usually the thing people do not notice until it matters.