What is the CVSS score of CVE-2026-48575?

CVE-2026-48575 has a CVSS 3.1 base score of 7.9 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Windows Secure Boot are affected by CVE-2026-48575?

Windows Secure Boot bypass (CVE-2026-48575) allows high-privilege local attackers to defeat platform boot-time integrity controls, enabling persistent pre-OS malware implantation.. A patch is available.

How to fix or mitigate CVE-2026-48575?

Within 24 hours: inventory Windows systems with Secure Boot enabled and audit high-privilege local account access. Within 7 days: contact Microsoft for interim guidance and patch timeline; implement UEFI firmware write-protection and restrict firmware modification access. Within 30 days: establish continuous endpoint monitoring for unauthorized pre-boot activity; track Microsoft security advisories for patch release and deploy immediately upon availability.

Windows Secure Boot CVE-2026-48575

EUVD-2026-35524 HIGH

Protection Mechanism Failure (CWE-693)

2026-06-09 secure@microsoft.com

GHSA-w4hq-xj64-h4pm

Authentication Bypass Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.9

CVSS 3.1 · Vendor: microsoft

Temporal: 6.9

Severity by source

Vendor (microsoft) PRIMARY

7.9 HIGH

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

CIRCL (temporal)

6.9 MEDIUM

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 17:47 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.9

DescriptionCVE.org

Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

AnalysisAI

Secure Boot bypass in Windows allows a local attacker with high privileges to defeat the platform's boot-time integrity protection mechanism, breaking the chain of trust that prevents unauthorized bootloaders and pre-OS code from executing. The flaw (CWE-693, Protection Mechanism Failure) carries a CVSS 7.9 due to scope change and high confidentiality/integrity impact, and no public exploit identified at time of analysis. Successful exploitation undermines a foundational anti-tamper control and can enable persistent pre-OS implants such as bootkits.

Technical ContextAI

Secure Boot is a UEFI-based protection that validates the cryptographic signatures of bootloaders, option ROMs, and the OS loader against a database of trusted keys (db/dbx) before they are allowed to execute, anchoring the Windows boot chain to a hardware root of trust. CWE-693 (Protection Mechanism Failure) indicates the control itself fails to enforce its intended policy - typically because a check is missing, can be skipped, or trusts attacker-influenced state - rather than a memory-corruption or injection bug. In Windows this layer integrates with components such as the Windows Boot Manager, BitLocker measurements, VBS/HVCI, and the dbx revocation list shipped through Windows Update; a bypass at this layer therefore weakens every downstream defense that assumes a verified boot.

RemediationAI

Apply the Microsoft security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48575 to all affected Windows systems; exact fix build numbers per SKU are listed on that page and should be cited from there rather than guessed. Because Secure Boot fixes frequently ship in two stages (an OS-side code update followed by a dbx/UEFI revocation that must be explicitly enabled), administrators should confirm whether this CVE requires deploying an updated UEFI revocation list (dbx) and follow Microsoft's staged enablement guidance to avoid bricking dual-boot or older recovery media. Compensating controls until patched include enforcing BitLocker with TPM+PIN so an attacker who bypasses Secure Boot cannot transparently access disk contents, requiring physical security and tamper-evident seals on high-value endpoints, restricting local administrator membership via LAPS and tiered admin to minimize the PR:H prerequisite, and monitoring measured-boot/TPM PCR values through Device Health Attestation to detect boot-chain tampering - each of these reduces but does not eliminate exposure, and BitLocker with PIN in particular adds user-experience cost.