Windows Secure Boot CVE-2026-48573

Exploitation requires local code execution on the target Windows machine with high privileges (CVSS PR:H - administrator/SYSTEM or equivalent) and the ability to interact with Secure Boot policy or the pre-OS boot components; no user interaction is needed once that foothold exists (UI:N), and the attack vector is local (AV:L), so it cannot be triggered across the network. Limiting factors that defenders should weigh: the attacker must already be admin (so this is a post-compromise capability, not an initial-access bug), Secure Boot must be enabled on the host for the bypass to be meaningful, and the attack does not impact availability (A:N) - it is about subverting trust, not crashing systems. Specific Windows builds and whether physical access is required are not disclosed in the inputs and must be confirmed against the MSRC advisory.

The CVSS vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N describes a high-privilege local attacker who can change scope and break confidentiality and integrity but not availability - characteristic of a Secure Boot/code-integrity bypass rather than a remote RCE. There is no KEV listing and no public exploit identified at time of analysis, and EPSS data was not provided in the source material, so this should be treated as a defense-in-depth weakness rather than a frontline emergency. The realistic risk is concentrated where attackers already have administrative or physical foothold and want to install persistent pre-OS implants (bootkits) or evade BitLocker/HVCI; for standard end-user fleets without that adversary model, urgency is lower than the 7.9 score alone suggests. Key data gap: the MSRC page is the only reference and the underlying technical mechanism (which component, which signature check) is not disclosed in the inputs, so attacker capability cannot be independently corroborated.

An attacker who has already obtained administrative rights on a Windows endpoint - for example via a phishing-delivered loader or stolen IT credentials - uses this flaw to write a malicious bootloader that the platform's Secure Boot check still accepts, surviving OS reinstalls and evading endpoint defenses. The result is a stealth bootkit that loads before Windows, undermines BitLocker/HVCI guarantees, and provides long-term persistence. No public exploit identified at time of analysis, so this scenario assumes adversary-developed tooling.