Home

Description

Multiple Microsoft-sigend UEFI SHIM bootloaders are vulnerable to SecureBoot bypass. An attacker with administrative privileges or the ability to modify the boot process could use one of the vulnerable shim bootloaders to bypass Secure Boot protections and execute arbitrary code before the operating system loads. Specific UEFI DBX update is required to block these vulnerable boot loaders.

PUBLISHED Reserved 2026-05-18 | Published 2026-06-09 | Updated 2026-06-09 | Assigner certcc

Problem types

CWE-347: Improper Verification of Cryptographic Signature

CWE-354: Improper Validation of Integrity Check Value

Product status

0.9
affected

14 (custom)
affected

15 (custom)
affected

15 (custom)
affected

14 (custom)
affected

6.9 (custom)
affected

6.9 (custom)
affected

4.2
affected

8.0.0 (custom)
affected

* (custom)
affected

1.0.0
affected

R9
affected

R10
affected

Credits

Thanks to Martin Smolar of ESET for discovering and reporting this vulnerability finder

References

www.kb.cert.org/vuls/id/616257

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-8863 (Microsoft Vendor Security Advisory) vendor-advisory

kb.cert.org/vuls/id/616257 (CERT/CC Vulnerability Notice) third-party-advisory

cve.org (CVE-2026-8863)

nvd.nist.gov (CVE-2026-8863)

Download JSON