Windows Secure Boot EUVD-2026-35525

Attacker must already have high-privilege (administrative) local access to the target Windows system and the ability to write to Secure Boot-relevant boot components or UEFI variables; no user interaction is required, but physical or interactive logon-equivalent access on the host is needed because the attack vector is local (AV:L). Exploitation is limited by the PR:H requirement (standard users cannot trigger it), by Secure Boot needing to be enabled in the first place for a meaningful bypass, and by platform firmware/DBX state that may already revoke some of the abusable components; environments enforcing least privilege, LAPS-managed local admins, and TPM-backed BitLocker materially shrink the realistic attack surface.

The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) describes a local, low-complexity attack requiring high privileges with no user interaction, where scope changes to compromise components beyond the initial security boundary - exactly the profile of an admin-to-firmware/boot trust escalation rather than a remote takeover. There is no CISA KEV listing, no published EPSS score in the provided data, and no public exploit identified at time of analysis, so this is not currently a mass-exploitation risk; however, Secure Boot bypasses are historically attractive to advanced actors (e.g., BlackLotus-class bootkits) because they enable stealthy, persistent footholds that survive OS reinstalls. The realistic priority is high for endpoints handling sensitive data or operating in higher-threat environments, and moderate for general fleets - patch promptly but it is unlikely to be opportunistically exploited at scale. Notable data gap: only the MSRC reference is provided with no detailed advisory text, KB number, or affected-build list in the input, so exact Windows SKUs and revocation steps must be confirmed against the live MSRC entry.

An attacker who has already obtained administrative access on a Windows host - for example through prior credential theft, a separate privilege escalation, or insider abuse - leverages the Secure Boot protection-mechanism failure to install an unsigned or revoked bootloader component. On the next reboot the tampered boot chain loads before the OS, giving the attacker a bootkit-class foothold that survives OS reinstallation and can disable or blind endpoint defenses; no public exploit has been identified at time of analysis.