What is the CVSS score of CVE-2026-48570?

CVE-2026-48570 has a CVSS 3.1 base score of 7.9 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Windows Secure Boot are affected by CVE-2026-48570?

Microsoft Windows Secure Boot bypass (CVE-2026-48570) allows administrators to circumvent firmware-level boot integrity protections, enabling persistent malware installation before the operating…. A patch is available.

How to fix or mitigate CVE-2026-48570?

Within 24 hours: Audit and inventory all local administrator accounts; restrict administrative access to essential personnel only. Within 7 days: Enable Enhanced Secure Boot enforcement, lock UEFI firmware settings with strong passwords, and deploy firmware monitoring tools to detect unauthorized changes. Within 30 days: Implement privileged access management (PAM) solution requiring MFA for administrative actions; establish continuous firmware integrity monitoring via EDR solutions that support Measured Boot validation.

Windows Secure Boot CVE-2026-48570

EUVD-2026-35522 HIGH

Protection Mechanism Failure (CWE-693)

2026-06-09 secure@microsoft.com

GHSA-c753-x75x-629c

Authentication Bypass Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.9

CVSS 3.1 · Vendor: microsoft

Temporal: 7.1

Severity by source

Vendor (microsoft) PRIMARY

7.9 HIGH

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

CIRCL (temporal)

7.1 HIGH

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 17:48 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.9

DescriptionCVE.org

Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

AnalysisAI

Secure Boot bypass in Microsoft Windows allows an authorized local attacker with high privileges to defeat the firmware-level boot integrity protection, breaking the chain of trust intended to prevent unauthorized boot-time code. The CVSS 7.9 rating with scope change (S:C) indicates the bypass affects components beyond the initially compromised context, enabling pre-OS persistence. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

Secure Boot is a UEFI firmware feature that verifies the cryptographic signature of bootloaders, kernels, and early drivers against keys stored in the platform's firmware (PK, KEK, db, dbx databases) before executing them, establishing a hardware-rooted chain of trust. The CWE-693 classification (Protection Mechanism Failure) indicates the security control itself is being circumvented rather than a memory-corruption or input-validation flaw - typically meaning a signed-but-vulnerable component, revocation list (dbx) gap, or a flaw in how Windows validates boot-time artifacts. Because the vector is local with high privileges (AV:L/PR:H), the attacker is already on the system and is leveraging that position to plant code that survives or precedes OS-level defenses such as Credential Guard, BitLocker integrity checks, and Defender ELAM.

RemediationAI

Apply the Microsoft security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48570 as soon as the patch identifier and KB numbers are confirmed for the relevant Windows builds; Secure Boot fixes frequently require both an OS patch and a separate dbx (forbidden signature database) update, and on some platforms a firmware/UEFI update from the OEM may also be necessary to fully revoke vulnerable components. Patch available per vendor advisory; exact fix version was not included in the provided input data. As compensating controls until patched, restrict local administrator and SYSTEM-level access via tiered admin models and LAPS to reduce the PR:H prerequisite, enable BitLocker with TPM+PIN so that bootloader tampering invalidates the sealed key and forces recovery, deploy Windows Defender Application Control / WDAC policies to constrain what signed binaries can run at boot, and monitor measured-boot TPM PCR values via attestation (e.g., Microsoft Intune device health attestation) to detect bootchain changes - note that aggressive WDAC and PCR-binding policies can cause boot failures after legitimate firmware updates and require operational planning.