Windows Secure Boot CVE-2026-45588

Exploitation requires local code execution on the target Windows host with high privileges (PR:H per the CVSS vector - practically, administrator or SYSTEM), and Secure Boot must be enabled and enforcing on the platform for the bypass to have meaning. No user interaction is needed (UI:N) and no network access is required (AV:L), so once admin is held the attacker can act unattended. Limiting factors are significant: the attacker must already have crossed the user-to-admin boundary by other means, the target must be a Windows system with UEFI/Secure Boot configured (not legacy BIOS), and exploitation generally requires a reboot for the malicious boot artifact to execute - giving defenders an EDR/boot-integrity window to detect anomalous bootloader writes or UEFI variable changes.

The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) describes a local attack requiring high privileges with no user interaction, scope-changed because compromising Secure Boot escapes the OS trust boundary into the firmware/pre-boot domain. EPSS data was not provided and the CVE is not on CISA KEV, with no public exploit identified at time of analysis - so this is not a mass-exploitation candidate. However, this is the classic profile for post-compromise persistence used by sophisticated threat actors (bootkits such as BlackLotus exploited prior Secure Boot bypasses), so real-world priority is high for organizations handling sensitive data, executives, or critical infrastructure even though opportunistic risk is low. Key data gaps to flag: no CPE list (exact Windows versions affected unknown until MSRC page is consulted), no EPSS, and no indication whether dbx revocation will be part of the fix.

An attacker who has already obtained local administrator privileges on a Windows endpoint - for example via a prior phishing-to-admin-escalation chain or stolen privileged credentials - writes a malicious bootloader or UEFI variable that exploits the protection-mechanism flaw to be accepted by Secure Boot on the next reboot. The implanted bootkit then loads before Windows, disables endpoint security agents, and persists across OS reinstalls and disk reformats. No public exploit identified at time of analysis, but this primitive is the textbook precursor to a bootkit similar to BlackLotus.