Windows Secure Boot EUVD-2026-35521

Local code execution on the target Windows host with high privileges (Administrator or SYSTEM, per CVSS PR:H) is required, and no user interaction is needed (UI:N) - meaning the attacker must already have compromised a privileged account or process before triggering the Secure Boot bypass. Exploitation is limited by the need for that privileged foothold, by physical or logical access sufficient to cause a reboot so the tampered boot chain executes, and by the specific Windows builds enumerated in the MSRC advisory (not provided in this intelligence package and must be confirmed against the vendor guide). Environments that enforce Credential Guard, LAPS-managed local admins, and TPM-backed remote attestation materially raise the bar because they constrain the PR:H precondition and surface post-bypass tampering.

The CVSS vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N describes a locally-exploitable issue requiring an attacker who already holds high privileges (typically Administrator/SYSTEM) on a Windows host, with no user interaction. That precondition substantially limits opportunistic exploitation: this is not a remote drive-by but a post-compromise capability that lets a privileged adversary subvert the platform's root of trust to install a bootkit or persist beneath the OS. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied, so quantitative exploitation likelihood cannot be cited; missing data includes affected Windows builds, KB numbers, CPE strings, and any vendor SSVC assessment - only a single MSRC reference is provided. Despite the high-privilege precondition, defenders running attestation, BitLocker, or Credential Guard should treat this as a meaningful integrity risk because a Secure Boot bypass can invalidate measured-boot and remote-attestation guarantees.

An attacker who has already obtained Administrator/SYSTEM on a target workstation - for example via phishing followed by a UAC bypass or a stolen Tier-0 credential - invokes the vulnerable Secure Boot protection-mechanism flaw to load an unsigned or revoked boot-stage component on the next reboot. From that foothold beneath the OS they install a UEFI bootkit that survives reinstallation and disk wipes, disables endpoint telemetry before it loads, and silently exfiltrates BitLocker keys or attestation secrets. No public exploit identified at time of analysis, so this scenario is derived from the CVSS vector (AV:L/PR:H/S:C) and the CWE-693 protection-failure class rather than an observed in-the-wild chain.