Windows Secure Boot CVE-2026-48570

Attacker must already have high-privilege local code execution on the target Windows host (CVSS PR:H, AV:L) - practically meaning Administrator or SYSTEM context - and must be able to write to or influence boot-relevant components that Secure Boot validates. No user interaction is required (UI:N). Exploitation is limited by the prerequisite admin foothold, by physical/remote-management access to trigger a reboot for the bypassed bootchain to take effect, and by whether the host's firmware has up-to-date dbx revocation entries that may neutralize some bypass primitives.

The CVSS 7.9 reflects a meaningful but constrained risk: AV:L and PR:H require an attacker who is already executing code with administrative privileges on the target, which substantially limits opportunistic exploitation. However, the S:C (scope change) and C:H/I:H impact metrics show that once exploited, the consequences cross a trust boundary - typically into firmware/pre-OS state - which is exactly the post-exploitation primitive that ransomware and APT actors seek for persistence and EDR evasion. EPSS data was not provided in the input, and the CVE is not currently in CISA KEV, so this is best treated as a high-value secondary objective for adversaries who have already obtained admin/SYSTEM rather than an internet-facing emergency. No public exploit identified at time of analysis; the threat model is consistent with bootkit-style follow-on activity (e.g., BlackLotus-class threats) where Secure Boot bypasses are chained after initial compromise.

An attacker who has already obtained administrative privileges on a Windows endpoint - for example via a phishing-delivered loader that escalated through a separate LPE - invokes the flawed Secure Boot validation path to install a malicious bootloader or pre-OS component that would normally be rejected as unsigned or revoked. On next reboot the implant runs before Windows and its security agents initialize, giving the attacker stealthy persistence and the ability to tamper with kernel integrity protections. No public exploit identified at time of analysis, so this scenario assumes custom tooling consistent with known bootkit tradecraft.