Windows Secure Boot CVE-2026-102221

Requires pre-existing high-privilege local access (CVSS PR:H) to a Windows system with Secure Boot enabled - this is not a remote or unauthenticated vector (AV:L, no network path). The flaw lies in improper certificate/bootloader revocation checking (CWE-299), so realistic exploitation means an administrator-level attacker using the weakness to load a revoked or untrusted boot component that Secure Boot should reject. Limiting factors: Secure Boot must be in use for the bypass to matter, the attacker must already hold administrator/SYSTEM privileges, and impact is confined to boot-chain integrity (no confidentiality or availability loss). Affected builds are the pre-patch Windows 10/11 and Windows Server 2016-2025 versions listed in the EUVD data; patched builds remediate the check.

This is a genuine but comparatively low-urgency issue. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N, base 4.4 Medium) is internally consistent with a local Secure Boot bypass: the attacker must already be local (AV:L) and already hold high privileges (PR:H, i.e. administrator/SYSTEM), and the only impact is to integrity (I:H) - specifically the integrity of the boot trust chain - with no confidentiality or availability loss. The PR:H requirement is the dominant mitigating factor: an attacker who can exploit this already has elevated local control, so the real-world value is persistence/tamper (defeating Secure Boot to load unsigned or revoked boot components) rather than initial access or privilege escalation. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active or widespread exploitation. CWE-299 (Improper Check for Certificate Revocation) aligns with the Secure Boot context - a revoked certificate/bootloader not being properly rejected. No SSVC decision data was supplied. Signals are consistent with each other (local, high-privilege, integrity-only), so there is no CVSS-versus-description conflict to resolve; the main caveat is that all detail derives from a single terse NVD/MSRC entry.

An attacker who has already gained administrative/SYSTEM-level access to a Windows host abuses the improper revocation check to install a revoked or otherwise untrusted bootloader/boot component that Secure Boot should have blocked, re-establishing a tamper-resistant foothold that survives reboot. No public exploit code is available, and because the attack vector is local with high privileges (AV:L/PR:H), exploitation presupposes prior compromise rather than remote entry.