Windows Secure Boot EUVD-2026-35524

Apply the Microsoft security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48575 to all affected Windows systems; exact fix build numbers per SKU are listed on that page and should be cited from there rather than guessed. Because Secure Boot fixes frequently ship in two stages (an OS-side code update followed by a dbx/UEFI revocation that must be explicitly enabled), administrators should confirm whether this CVE requires deploying an updated UEFI revocation list (dbx) and follow Microsoft's staged enablement guidance to avoid bricking dual-boot or older recovery media. Compensating controls until patched include enforcing BitLocker with TPM+PIN so an attacker who bypasses Secure Boot cannot transparently access disk contents, requiring physical security and tamper-evident seals on high-value endpoints, restricting local administrator membership via LAPS and tiered admin to minimize the PR:H prerequisite, and monitoring measured-boot/TPM PCR values through Device Health Attestation to detect boot-chain tampering - each of these reduces but does not eliminate exposure, and BitLocker with PIN in particular adds user-experience cost.