Windows Secure Boot CVE-2026-41097

Requires an authorized local attacker with high privileges - confirmed by CVSS AV:L/PR:H - specifically local administrator or equivalent rights sufficient to write to or invoke boot configuration paths. Remote exploitation is not possible; physical or authenticated local session access is mandatory. Secure Boot must be enabled on the target system, as that is the security feature being bypassed (systems with Secure Boot disabled are not affected by this specific flaw). The attacker must additionally have the ability to interact with boot configuration or replace boot stage files, implying either prior compromise, insider threat, or physical access. Exploitation cannot be automated at scale (SSVC: Automatable: no) due to the interactive local access requirement. The PR:H prerequisite is the primary limiting factor - an attacker must already hold a highly privileged local position before this vulnerability is useful, making it a post-compromise persistence mechanism rather than an initial access vector.

The CVSS base score of 6.7 is well-calibrated: the AV:L/PR:H constraint limits the attack surface to local administrators who have already achieved a highly privileged position, which materially narrows real-world exposure. The EPSS score of 0.23% (46th percentile) indicates low near-term exploitation probability, consistent with CISA SSVC's ratings of 'exploitation: none' and 'automatable: no.' Despite this, SSVC correctly rates technical impact as 'total' - successful exploitation fully defeats the boot integrity boundary. The realistic risk model is a targeted post-compromise persistence scenario: a threat actor who has already gained local admin access uses this flaw to install a bootkit that survives OS reinstalls and evades EDR solutions that initialize after the OS. Mass exploitation is implausible given the local-only attack vector and PR:H requirement. These signals are consistent - this is a narrowly applicable but severe privilege-escalation-to-persistence primitive, most relevant to nation-state and advanced persistent threat actors targeting high-value systems. No conflicts between CVSS and real-world signals were identified.

An attacker who has already obtained local administrator privileges on a Windows 10/11 or Windows Server system invokes a permanently trusted, non-updateable signed boot component to chain-load an unsigned malicious bootloader, bypassing Secure Boot signature enforcement before the OS initializes. The modified boot path allows injection of a persistent bootkit or kernel rootkit that survives OS reinstallation and can evade detection tools that load after the OS. No public exploit code has been identified at time of analysis, but the Secure Boot bypass technique exploiting non-revocable signed components is well-documented in academic and security research contexts.