Windows UEFI CVE-2026-49785

Exploitation requires the attacker to already have local, authenticated access to the Windows host with at least low privileges (CVSS PR:L, AV:L) - it is not remotely reachable and needs no user interaction once local. The limiting factors are therefore the prerequisite local foothold and existing account/privilege on the system; there is no indication of a required non-default configuration, but the specific UEFI security feature being bypassed (likely a boot-integrity feature such as Secure Boot) is not named in the input and should be confirmed against the Microsoft MSRC advisory. No active exploitation or public POC reduces near-term practical risk.

This is a moderate-priority local vulnerability rather than an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) requires an attacker to already have local access with some privileges on the Windows host, which substantially limits remote mass-exploitation; the 7.8 base score is driven by the C:H/I:H/A:H impact set, consistent with SSVC's 'Technical Impact: total' rating for a UEFI/Secure-Boot-class security-feature bypass. However, exploitation signals are weak-to-absent: SSVC reports Exploitation 'none' and Automatable 'no', there is no CISA KEV listing, and no public POC is indicated - so this is a high-impact-but-not-yet-exploited issue, not an actively weaponized one. Note a terminology tension in the input: the Description characterizes this as bypassing 'a security feature,' while the Tags label it 'Authentication Bypass' - these are distinct categories (Microsoft classifies this as a Security Feature Bypass), so defenders should treat the 'Authentication Bypass' label with caution. A patch is available from Microsoft, so remediation is straightforward and should follow normal privileged/boot-path patching cadence.

An attacker who already has a low-privileged authenticated foothold on a Windows system (for example via prior compromise or malware) abuses the improper resource shutdown/release defect in the UEFI code path to bypass a boot-time security feature such as Secure Boot. This could let them persist below the OS or disable an integrity protection; exploitation is purely local and no public exploit code is identified at time of analysis.