EUVD-2026-29685
GHSA-mp9v-4xwc-g9hx
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Local-only attack requiring high privileges to access boot configuration; full C/I/A reflects complete subversion of the pre-OS boot integrity boundary.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Reliance on a component that is not updateable in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.
AnalysisAI
Windows Secure Boot bypass across Windows 10 version 1809 through Windows 11 version 26H1 and multiple Windows Server editions allows an authorized local administrator to circumvent boot-time integrity protections by exploiting a non-updateable boot chain component. A successful attacker can subvert the UEFI Secure Boot trust chain to load unsigned or malicious code at the pre-OS stage, enabling persistent bootkit or rootkit implantation that survives OS reinstallation. No public exploit code has been identified and CISA SSVC reports no active exploitation, though the SSVC technical impact rating of 'total' correctly reflects full defeat of the boot integrity boundary.
Technical ContextAI
CWE-1329 (Reliance on Component That is Not Updateable) identifies a structural weakness in the UEFI Secure Boot chain: one or more Windows boot components - most likely a signed bootloader or UEFI shim - carry a permanently trusted signature that cannot be revoked through standard Windows Update mechanisms or added to the UEFI DBX (Secure Boot Forbidden Signature Database). Secure Boot validates cryptographic signatures at each boot stage before execution; if a component in that chain is structurally non-revocable, an attacker with high local privileges can invoke that component to bypass signature enforcement for subsequent boot stages. Affected CPE strings confirm the scope spans Microsoft Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 22H3, 23H2, 24H2, 25H2, and 26H1; and Windows Server 2019, 2022, 2022 23H2, and 2025, all on x86/x64 platforms.
RemediationAI
Vendor-released patches are available from Microsoft at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41097. Apply the cumulative update targeting the following fixed builds: Windows 10 1809 and Server 2019 to 10.0.17763.8755 or later; Windows 10 21H2 to 10.0.19044.7291 or later; Windows 10 22H2 to 10.0.19045.7291 or later; Windows 11 22H3 and 23H2 to 10.0.22631.7079 or later; Windows 11 24H2 to 10.0.26100.8457 or later; Windows Server 2025 to 10.0.26100.32860 or later; Windows 11 25H2 to 10.0.26200.8457 or later; Windows 11 26H1 to 10.0.28000.2113 or later; Windows Server 2022 to 10.0.20348.5139 or later; Windows Server 2022 23H2 to 10.0.25398.2330 or later. Note that Secure Boot bypass mitigations involving non-updateable signed components may also require a separate UEFI DBX revocation update to remove the vulnerable component from the firmware trust database - confirm with Microsoft guidance whether this is required. As a compensating control for systems that cannot be patched immediately, enforce Privileged Access Workstation (PAW) policies and limit local administrator group membership to reduce the likelihood of an attacker reaching the PR:H threshold required for exploitation. Restricting boot configuration changes via UEFI firmware passwords adds an additional barrier.
More in Windows 10 Version 1809
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today