Cve checks

Known CVE checks

Version 16.0 adds a separate category for known Windows 10 and Windows 11 issues Bastion can scan on a personal PC you administer. Open it from main menu C, or Recovery 9, then 7. An optional Apply section CveChecks exists and stays off by default (not in Quick Harden).

The public operator page (scan and reverse keys) is Known CVE checks. Full write-ups and sources are CVE advisories. Phone-friendly reverse steps: Help: CVE checks.

What this is

A catalogue with live status. Each row is detected on this PC. Where a reliable, non-exploit remediation exists, Bastion offers it after you confirm. Scan prints what it is doing while it runs.

Bastion cannot patch Microsoft kernel, Advanced Local Procedure Call, Update Stack, or Defender platform bugs. Those rows start Windows Update or a Defender signature and platform update. Registry, protocol, SMBv1, and application-uninstall rows are compensating controls you can reverse when Bastion recorded them.

How to run it

1. Create a System Restore Point (main menu 13 or R) if you plan to remediate.
2. Run Bastion-Hardening.bat as Administrator.
3. Main menu C.
4. Option 1 scan (read-only). Watch the [n/total] lines.
5. Option 2 remediates Exposed rows after Yes, or option 3 one row.

Exact reverse (registry and protocol Bastion recorded)

1. Run Bastion-Hardening.bat as Administrator and accept User Account Control.
2. Main menu 9 (Recovery / fix).
3. Press 7 (Known CVE checks).
4. Press 1 for a read-only scan, or 2 then Yes to restore Bastion-CveUndo.json.
5. Press 3 for the same catalogue menu as main menu C.
6. Optional daily Defender health task: Recovery 9, then 6, then Defender, then 5, then option 5, then Yes. That task never deletes files.

Hub 7 does not uninstall a Microsoft update, re-enable SMBv1, or put VLC back. Inbound firewall group locks from the FIREWALL-LAN row reverse under Recovery 9, then 3 Network. System Restore remains the strongest full rollback.

Catalogue (version 16.0)

Id	Identifiers	What Bastion does
WIN-SEP2026	CVE-2026-85880, CVE-2026-81963, CVE-2026-62721, CVE-2026-85921	Detect build and update build revision versus September 2026 cumulative and out-of-band floors (25H2/24H2 healthy at UBR 9457 / KB5129195). Start a Windows Update scan and open Settings. You click Download and restart. Microsoft also confirmed Always On VPN and Machine Identity Isolation domain-trust issues on KB5124008. DNS Client 7023 is a field observation, not a Microsoft known issue. See September 2026 Windows update.
OFFICE-SEP2026	CVE-2026-78509, CVE-2026-78510	If Office is installed, start Click-to-Run. You finish File > Account > Update Now and restart Outlook/Word.
DEFENDER-UNDEFEND	CVE-2026-45498 UnDefend	Platform must be 4.18.26040.7 or later; request a signature and platform update
DEFENDER-REDSUN	CVE-2026-41091 RedSun	Engine must be 1.1.26040.8 or later; same update path
BIGDISKBUSTER	Public proof of concept, no CVE identifier	Disk, signature age, hidden temporary fill files; confirm delete and signature update
SMBV1	CVE-2017-0144 class	Disable optional SMB1Protocol
FIREWALL-LAN	Network-facing SMB/print/RDP/WinRM path	Lock inbound File Sharing, SMBDirect, Discovery, RDP, WinRM, mDNS groups; report all-interface 139/445/RDP/WinRM listeners. Reverse is Recovery hub 3
SMB-COMPRESSION	CVE-2020-0796	DisableCompression=1 on LanmanServer (reversible)
RDP-NLA	Remote Desktop NLA	UserAuthentication=1 (reversible)
PRINTNIGHTMARE	CVE-2021-34527 / 1675 / 34481	RestrictDriverInstallationToAdministrators=1 (reversible)
FOLLINA	CVE-2022-30190	Optional ms-msdt protocol removal with .reg backup; not during Apply
CERT-PADDING	CVE-2013-3900	EnableCertPaddingCheck=1 (reversible)
WDIGEST	Credential cache	UseLogonCredential=0 if someone set 1 (reversible)
ALWAYSINSTALLELEVATED	Misconfiguration	Set both installer policies to 0 (reversible)
VLC-2026	CVE-2026-56711 / CVE-2026-73324	Detect 3.0.0 through 3.0.23; uninstall only after Yes on menu C

Honesty

Bastion does not ship exploit payloads and does not copy public proofs of concept. Third-party antivirus turning Defender real-time protection off is a product conflict, not this catalogue. Windows Update still needs you to finish in Settings and restart if Windows asks. VLC reinstall is the vendor installer. Check Point, PeopleSoft, WordPress, and Next.js ImageResponse are out of scope for this Windows workstation tool.

What else is in the current v16.0 zip

Product version stays 16.0. The current GitHub Latest zip includes the 16.0 patch line: FIREWALL-LAN (including SMBDirect), Office Click-to-Run reminder, SMBv3 DisableCompression, RDP NLA, finish-it-yourself banners so you complete Windows Update / Office / Defender yourself, CVE undo items wrapped with DPAPI (no plaintext fallback), a tight ACL on Bastion-owned data folders, and a scan cache for Defender, SMBv1, and firewall rows. Office detect no longer walks the full Uninstall hive.

There is one public v16.0 release. Prefer GitHub Latest or the official download.

See also the Recovery cookbook hub 7, September 2026 Windows update, and KNOWN-ISSUES.