Microsoft has quietly fixed a Windows 11 vulnerability that inadvertently recorded sensitive passkey authentication data inside event logs, a flaw that could have given attackers a path to elevated access in enterprise environments. The update, released July 14, addresses CVE-2026-34348—a protection-mechanism failure in the Windows Event Logging Service that allowed an attacker with low privileges to read information that should have been hidden. The patch arrived weeks before security researcher Michael Grafnetter is set to demonstrate the practical impact of such leaks in a Black Hat USA talk, but for everyday users the most important step is already clear: apply the update and review how your passkeys are managed.

The Patched Vulnerability Explained

CVE-2026-34348, as recorded in the National Vulnerability Database, stems from a failure in the Windows Event Logging Service to properly protect authentication-related data. Attackers with network access—and only low privileges—could exploit the weakness with low complexity, potentially exposing information that Windows should never have written to logs in the first place. Microsoft assigned it a 6.5 CVSS 3.1 Medium severity score, noting that high confidentiality impact but no known active exploitation.

The practical scenario, according to Notebookcheck’s reporting, is more concerning in managed environments. Grafnetter identified a chain in which Windows 11’s event logs recorded cleartext passkey-related material—such as past YubiKey signatures read by unprivileged users—and Microsoft Entra ID did not sufficiently prevent reuse of that data. Together, the missteps could have allowed an attacker to impersonate privileged cloud accounts, bypass even phishing-resistant multi-factor authentication (MFA), and evade popular detection tools. Microsoft patched the Windows bug on July 14 and also fixed the cloud-side behavior without a separate advisory.

For the typical home user, the risk is lower because the attack requires an attacker already on the network with some authenticated access. But for businesses using Windows 11 with Entra ID, the flaw introduced a dangerous information leak that could turn a low-level compromise into full account takeover.

Does Your Windows 11 PC Need This Fix?

Yes—the patch is part of the July 2026 security update and should already be installed if you have automatic updates enabled. There is no extra step beyond confirming the update is applied. For organizations, the priority should be on privileged workstations, administrator laptops, and any server that handles identity or event logging.

The fix is only the beginning, however. The real lesson is that passkeys rely on more than just cryptographic design. If Windows event logging, cloud validation, or credential lifecycle management leak information, the entire authentication chain weakens. That’s a stark reminder that going passwordless doesn’t eliminate the need for strong endpoint hygiene.

Why Passkeys Aren’t Broken—But Your Setup Might Be

Passkeys remain a massive security improvement over passwords. They use public-key cryptography: the website stores a public key, while the private key stays locked in your device’s secure enclave or a hardware key. When you sign in, the authenticator signs a challenge after local user verification, such as a fingerprint or PIN. Phishing sites can’t reuse the response, and database leaks of server-side public keys are worthless for impersonating you.

The flaw here didn’t break the FIDO2 standard. It exploited sloppy logging on the endpoint. Passkeys move the attack surface, they don’t remove it. The Pass-the-Passkey research, as Grafnetter named it, deliberately echoes the decades-old Pass-the-Hash technique: an adversary steals an authentication artifact and reuses it without ever knowing the original secret.

That’s why context matters as much as the credential itself. For most people, a synced passkey—managed through iCloud Keychain, Google Password Manager, or Microsoft’s own solution—is a fine upgrade. It stays phishing-resistant and is far more convenient than juggling passwords plus one-time codes. But if you’re an administrator or handle sensitive data, the extra isolation of a hardware security key makes sense. A FIDO2 key like a YubiKey keeps the private key on a separate chip, never synced to the cloud. If someone compromises your Microsoft account, they won’t also get the passkey that protects your most critical work.

Even hardware keys aren’t invulnerable: the 2024 EUCLEAK attack showed that certain older YubiKey firmware had a cryptographic weakness exploitable with physical access and specialized equipment. That’s why checking vendor advisories and keeping firmware up to date is essential. But for privileged roles, a device-bound key is still a strong defensive layer.

How We Got Here

Microsoft has been aggressively pushing passkeys. Starting September 1, 2026, new Entra ID users authenticated with SMS or voice will be prompted to register a passkey instead. By February 1, 2027, legacy SMS and voice MFA will be fully retired—anyone still relying on them will be blocked until they set up a passkey. This shift is strategically sound because SMS codes are notoriously weak against SIM-swapping and real-time phishing relays.

But research like Grafnetter’s shows that adoption without careful implementation can create new risks. The Black Hat USA session (August 1–6 in Las Vegas) will dive into chains that bypass even phishing-resistant MFA enforcement, impersonate privileged identities, and evade Extended Detection and Response (XDR) tools. Grafnetter is expected to release open-source tools so others can test their own environments.

The discovery and quick fix are evidence of a healthy security ecosystem. Yet the incident highlights that identity teams must think about the entire signal chain: the endpoint, the logs, the cloud protocols, and recovery paths. A passkey is only as strong as the weakest link around it.

What to Do Right Now

For all Windows 11 users:

  • Verify that the July 2026 security update is installed (check Windows Update).
  • Review saved passkeys: remove old devices and unused credentials from your Microsoft account passkey settings.
  • If you haven’t already, set up a second passkey on a different device—or a hardware key—as a backup.

For enterprise administrators:

  • Patch all Windows 11 endpoints immediately, prioritizing administrative workstations and identity-management servers.
  • Audit event log settings and restrict access to logs that might contain sensitive data, even after the patch.
  • Require hardware security keys for global administrators, help-desk staff, and any account with high privileges in Entra ID.
  • Disable legacy password fallbacks wherever possible. An active password login path remains the easiest attack vector, regardless of passkeys.
  • Review Entra ID Conditional Access policies: ensure that authentication alone isn’t the sole trust decision—factor in device compliance, location, and risk level.
  • Start planning for the September 2026 passkey default rollout and the February 2027 SMS retirement. Segment users by risk: ordinary employees can use synced passkeys, but executives and admins should get hardware keys with attestation and PIN protection.
  • Test recovery procedures. A lost or broken key shouldn’t lock someone out forever; have a secure offline recovery code and a help-desk process that doesn’t rely on easily spoofed personal information.

Looking Ahead: Microsoft’s Passkey Push and Your Next Steps

The momentum toward passwordless is only accelerating. With the Black Hat presentation drawing more attention, expect Microsoft to further tighten logging and credential handling. But the real work lies with admins and power users: passkeys shift the battle from mass phishing to targeted endpoint and configuration flaws. That’s a better fight, but only if you stay patched, manage privileged access tightly, and finally kill those old password back doors.

For most Windows users, the patch is already in place. Now’s the time to level up: pick a passkey strategy, add a backup, and pull the plug on that ancient, reused password.