What is the CVSS score of CVE-2026-48573?

CVE-2026-48573 has a CVSS 3.1 base score of 7.9 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Windows Secure Boot are affected by CVE-2026-48573?

A Secure Boot bypass vulnerability in Microsoft Windows (CVE-2026-48573) allows privileged local users to circumvent the platform's foundational boot integrity protection and tamper with the pre-OS…. A patch is available.

How to fix or mitigate CVE-2026-48573?

Within 24 hours: Inventory all Windows systems in your environment; prioritize systems with unrestricted local administrative access or running critical workloads. Within 7 days: Enable and enforce UEFI Secure Boot settings across all Windows devices; implement Credential Guard to protect privileged credentials; restrict local administrator privileges through privileged access management (PAM) solutions. Within 30 days: Monitor Microsoft Security Response Center (MSRC) for CVE-2026-48573 patch release; deploy boot firmware attestation tools on high-risk systems; audit UEFI firmware configurations and establish baseline integrity measurements.

Windows Secure Boot CVE-2026-48573

EUVD-2026-35523 HIGH

Reliance on Component That is Not Updateable (CWE-1329)

2026-06-09 secure@microsoft.com

GHSA-4gp7-mp63-x473

Authentication Bypass Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.9

CVSS 3.1 · Vendor: microsoft

Temporal: 6.9

Severity by source

Vendor (microsoft) PRIMARY

7.9 HIGH

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

CIRCL (temporal)

6.9 MEDIUM

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 17:48 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.9

DescriptionCVE.org

Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

AnalysisAI

Secure Boot bypass in Microsoft Windows allows an authorized local attacker with high privileges to defeat the platform's protection mechanism and tamper with the pre-OS boot chain. The CVSS 7.9 score reflects a scope-changing impact on confidentiality and integrity from a local vector, and no public exploit identified at time of analysis. The single MSRC reference indicates a Microsoft-tracked issue that primarily threatens code-integrity and boot-trust guarantees rather than runtime availability.

Technical ContextAI

Secure Boot is the UEFI firmware feature that validates the signatures of bootloaders, option ROMs, and early-OS components against a trusted key database (db/KEK/PK) before they are executed, anchoring the Windows trusted boot and measured boot chain. CWE-1329 (Reliance on a Component That is Not Updateable) points to a flaw where a fixed or non-updatable element of the boot trust chain - for example a hard-coded check, a signed component with revocable trust, or an embedded validation routine - can be leveraged to subvert verification. Because Secure Boot underpins downstream protections such as BitLocker measurements, VBS/HVCI, and Defender System Guard, a flaw here weakens the entire firmware-rooted trust hierarchy.

RemediationAI

Apply the Microsoft security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48573 to every affected Windows host, following the KB articles listed there for each Windows version (patch available per vendor advisory; exact fix build not enumerated in the provided inputs). Because Secure Boot fixes routinely require revoking previously trusted bootloaders, also deploy the corresponding DBX (Forbidden Signature Database) update and verify it took effect with Confirm-SecureBootUEFI and Get-SecureBootUEFI -Name dbx - be aware DBX revocations can render older recovery media, dual-boot Linux loaders, or unsigned vendor tools unbootable, so test before mass rollout. As compensating controls while patching is staged, restrict local administrator membership to reduce the population that can satisfy the PR:H prerequisite, enable BitLocker with TPM+PIN so that pre-boot tampering invalidates the key release, and turn on HVCI/Memory Integrity plus measured boot reporting (Defender for Endpoint attack surface telemetry or Intune attestation) to detect boot-chain anomalies; none of these stop the bypass itself but they raise the cost of weaponizing it.