What is the CVSS score of CVE-2026-48578?

CVE-2026-48578 has a CVSS 3.1 base score of 7.9 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Windows Secure Boot are affected by CVE-2026-48578?

Windows Secure Boot contains an access control vulnerability (CVE-2026-48578, CVSS 7.9) that allows locally authenticated users with administrator privileges to bypass the system's boot-time…. A patch is available.

How to fix or mitigate CVE-2026-48578?

24 hours: Audit Windows systems with Secure Boot enabled and current administrator account assignments; implement restrictive policies to minimize unnecessary local admin privileges. 7 days: Escalate to Microsoft support for CVE-2026-48578 patch timeline; verify BIOS/UEFI updates from your system OEM for interim security hardening. 30 days: Deploy privileged access management (PAM) to control local administrator access; enable and verify measured boot and UEFI Secure Boot policy enforcement across all systems; prepare automated deployment of vendor patch upon release.

Windows Secure Boot CVE-2026-48578

EUVD-2026-35526 HIGH

Improper Access Control (CWE-284)

2026-06-09 secure@microsoft.com

GHSA-r54v-whx8-jvhg

Authentication Bypass Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.9

CVSS 3.1 · Vendor: microsoft

Temporal: 6.9

Severity by source

Vendor (microsoft) PRIMARY

7.9 HIGH

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

CIRCL (temporal)

6.9 MEDIUM

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 17:45 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.9

DescriptionCVE.org

Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

AnalysisAI

Security feature bypass in Windows Secure Boot enables a local high-privileged attacker to defeat the platform's boot-time integrity protections, achieving high confidentiality and integrity impact across a changed security scope. The flaw stems from a protection mechanism failure (CWE-284, Improper Access Control) that undermines the trust boundary Secure Boot is designed to enforce. At the time of analysis, no public exploit has been identified and the issue is not listed in CISA KEV, but the scope-changed CVSS of 7.9 reflects the severity of subverting a root-of-trust security control.

Technical ContextAI

Windows Secure Boot is a UEFI-based protection that validates the cryptographic signatures of bootloaders, the Windows OS loader, and early boot components against keys stored in platform firmware, preventing unsigned or tampered code from executing before the OS gains control. The underlying weakness is classified as CWE-284 (Improper Access Control), indicating that an access-control or policy-enforcement check that gates Secure Boot's protection logic can be circumvented. Because Secure Boot anchors the chain of trust that protections like BitLocker, Measured Boot, Virtualization-Based Security (VBS), and Hypervisor-Protected Code Integrity (HVCI) build upon, a bypass here can erode assurances those higher-layer controls depend on. The single vendor reference (MSRC) does not enumerate specific Windows builds in the supplied data, and no CPE strings were provided in this intelligence bundle.

RemediationAI

No vendor-released patch version was identified at time of analysis from the provided data; treat the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48578 as the authoritative source and apply the cumulative Windows security update referenced there for each affected SKU as soon as it is validated in your environment. Because Secure Boot bypass fixes frequently require both an OS update and a Secure Boot DBX (forbidden-signature database) revocation update, plan to deploy the corresponding UEFI Secure Boot revocation servicing (mssecureboot/DBX update) so that revoked bootloader components cannot be reintroduced - note this can render older recovery media, dual-boot installations, or unsigned third-party boot tooling unbootable, so test on representative hardware first. Compensating controls while patching: enforce BitLocker with TPM+PIN to raise the cost of physical or admin-level tampering with the boot chain, require attestation (Microsoft Defender for Endpoint device health attestation or Intune compliance with Secure Boot + Code Integrity attested) before granting access to sensitive resources, and tightly restrict local administrator membership via LAPS and tiered admin to limit who can meet the PR:H precondition; each of these reduces but does not eliminate residual risk until the firmware/OS update and DBX revocation are applied.