What is the CVSS score of CVE-2026-48576?

CVE-2026-48576 has a CVSS 3.1 base score of 7.9 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Windows Secure Boot are affected by CVE-2026-48576?

CVE-2026-48576 is a Secure Boot bypass vulnerability affecting Windows systems that allows local administrators or compromised admin accounts to disable boot integrity protections and install…. A patch is available.

How to fix or mitigate CVE-2026-48576?

Within 24 hours: Inventory Windows systems with Secure Boot enabled; audit and document all users and service accounts with local administrative privileges. Within 7 days: Implement kernel-mode monitoring for suspicious driver loads and UEFI access attempts; evaluate MFA enforcement for administrative credentials; prepare firmware and BIOS update procedures from OEM vendors. Within 30 days: Monitor Microsoft security bulletins and UEFI vendor advisories for patch availability; apply patches immediately upon release to all affected systems; implement compensating controls on systems where administrative access cannot be restricted.

Windows Secure Boot CVE-2026-48576

EUVD-2026-35525 HIGH

Reliance on Component That is Not Updateable (CWE-1329)

2026-06-09 secure@microsoft.com

GHSA-4636-q739-m8jq

Authentication Bypass Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.9

CVSS 3.1 · Vendor: microsoft

Temporal: 6.9

Severity by source

Vendor (microsoft) PRIMARY

7.9 HIGH

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

CIRCL (temporal)

6.9 MEDIUM

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 17:46 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.9

DescriptionCVE.org

Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

AnalysisAI

Security feature bypass in Windows Secure Boot allows a high-privileged local attacker to circumvent the boot integrity protection mechanism, undermining trust in the Windows boot chain. The flaw (CWE-1329, reliance on a component that is not updateable) carries a CVSS 7.9 rating due to scope change and high impact on confidentiality and integrity, and no public exploit has been identified at time of analysis. Successful exploitation could enable pre-OS persistence such as bootkits, defeating a foundational Windows security control.

Technical ContextAI

Secure Boot is the UEFI-based firmware feature that validates the cryptographic signatures of bootloaders, drivers, and the OS kernel against keys stored in firmware (PK, KEK, db, dbx) to prevent unauthorized code from running during boot. CWE-1329 (Reliance on Component That is Not Updateable) indicates the failure stems from a component in the boot chain whose trust anchors or validation logic cannot be readily revoked or updated, so an attacker who can influence that component can sidestep signature enforcement. Because Secure Boot underpins downstream defenses like BitLocker measured boot, Device Guard, and Virtualization-Based Security, a bypass here erodes the root of trust those features depend on.

RemediationAI

Patch available per vendor advisory - apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48576 as soon as it is published for your Windows edition, prioritizing endpoints with sensitive data, domain controllers, and hosts using BitLocker or VBS. Because Secure Boot fixes commonly require both an OS update and a DBX (forbidden signature) revocation that becomes effective after reboot, verify the DBX update applied successfully (e.g., via mokutil/PowerShell Get-SecureBootUEFI) and reboot the system; note that DBX updates can brick dual-boot configurations or older recovery media signed with revoked certificates, so test recovery media before mass rollout. As compensating controls until patching completes, enforce BitLocker with TPM+PIN to make offline boot tampering visible, restrict local administrator group membership (the PR:H prerequisite), and enable measured-boot/attestation logging through Microsoft Defender for Endpoint or an MDM attestation policy to detect post-boot integrity drift.