ESET warns that 11 old Microsoft-signed UEFI shim bootloaders can let attackers bypass Secure Boot on UEFI-based systems that trust the Microsoft Corporation UEFI CA 2011 certificate. Microsoft revoked the vulnerable shims in June 2026 and added them to the UEFI DBX, but administrators must update trusted boot components before applying revocations to avoid boot failures. #UEFI #SecureBoot #MicrosoftCorporationUEFICA2011 #CVE-2026-8863 #CVE-2026-10797 #CERTCC
Keypoints
- Eleven Microsoft-signed UEFI shim bootloaders were found vulnerable.
- The flaws can be used to bypass Secure Boot on UEFI-based machines.
- The affected shims were mainly version 0.9 and earlier.
- Microsoft revoked the vulnerable applications and placed them in the UEFI DBX.
- Admins must update trusted boot files before deploying DBX revocations.
Read More: https://www.securityweek.com/old-uefi-shims-expose-systems-to-secure-boot-bypass/