11 Old Microsoft-Signed UEFI Shims Could Bypass Secure Boot
Critical vulnerability discovered that can bypass Secure Boot mechanism.
1Discovery of the Vulnerability
ESET researchers have discovered a critical security flaw in 11 old Microsoft-signed UEFI shim bootloaders that allows bypassing the Secure Boot mechanism. This vulnerability enables malicious software to execute during system boot, posing a significant threat to system integrity.
2Affected Systems
The vulnerability impacts all UEFI-based machines that trust Microsoft's 'Microsoft Corporation UEFI CA 2011' certificate, regardless of the operating system. This includes many Linux distributions and other UEFI-based systems. Most affected shims are found in versions 0.9 and earlier.
3Attack Scenario
An attacker exploiting this vulnerability could execute arbitrary code during system boot. This allows the installation of malicious UEFI bootkits like Bootkitty, HybridPetya, or BlackLotus. Since the attack occurs before the OS loads, it can bypass traditional security measures.
4Microsoft's Mitigations
Following responsible disclosure, Microsoft revoked these old shims in its June 2026 Patch Tuesday update. However, systems that haven't applied this update remain at risk. While new certificates (Microsoft UEFI CA 2023) are now in use, delayed updates on older systems can still cause problems.
5BYOVD Technique
Attackers can exploit this vulnerability using the 'Bring Your Own Vulnerable Driver' (BYOVD) technique. This allows arbitrary code execution during the early boot phase, before the OS initializes. Even the Machine Owner Key (MOK) allowlist may fail to prevent such attacks.
6Impact and Recommendations
This vulnerability poses a serious threat, especially in enterprise environments. System administrators must urgently apply all UEFI and shim updates and review their Secure Boot configurations. The flaw is tracked as CVE-2026-8863 and CVE-2026-10797.
Original article: The Hacker News — 11 Eski Microsoft İmzalı UEFI Shim Güvenlik Açığı