Windows Secure Boot EUVD-2026-35526

Local code execution on the target Windows host with high privileges (administrator or SYSTEM, per CVSS PR:H and AV:L) is required; the attacker cannot reach the flaw remotely or as a standard user, and no user interaction is needed (UI:N). Exploitation is constrained to systems where Secure Boot is actually enabled and relied upon as a security boundary - endpoints with Secure Boot disabled in firmware, legacy/CSM-only boot, or non-UEFI platforms are not in scope because there is no protection to bypass. Practical limiters are therefore: the attacker must first achieve admin-equivalent access (raising the bar from initial compromise), and the value of the bypass is gated to environments where Secure Boot, BitLocker, VBS/HVCI, or remote attestation form part of the defended security model.

The CVSS:3.1 vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N indicates the attacker must already have local access with high privileges (typically administrator or SYSTEM), but once those preconditions are met the exploit is low-complexity, requires no user interaction, and crosses a security scope boundary to fully compromise confidentiality and integrity of components beyond the vulnerable one - consistent with subverting a firmware/early-boot trust boundary from within the OS. No EPSS score, KEV listing, SSVC decision, or POC indicator was supplied, so there is no public exploit identified at time of analysis and the realistic threat model is a post-compromise persistence/defense-evasion enabler (e.g., bootkit installation after an attacker already has admin) rather than an initial-access vector. The 7.9 score is therefore proportionate: meaningful for high-value endpoints (executives, domain controllers, KIOSKs, regulated workloads) where boot integrity is part of the security model, but lower priority than network-reachable unauthenticated RCEs. Notable data gaps: no specific Windows version list, no patch version, and no exploitation telemetry - all of which should be confirmed against the live MSRC advisory before final prioritization.

An attacker who has already obtained administrator/SYSTEM on a Windows endpoint - for example via phishing followed by privilege escalation, or a malicious insider on a managed laptop - invokes the flawed access-control path to disable or bypass Secure Boot enforcement, then writes an unsigned or revoked bootloader/driver that survives reboot. On next boot, the implanted component executes before Windows defenses load, giving the attacker kernel-level persistence and the ability to tamper with BitLocker, EDR, and VBS protections. No public proof-of-concept code has been identified at time of analysis, but the scope-changed CVSS profile is consistent with documented bootkit-style techniques.