EUVD-2026-35570
GHSA-26mx-r4q8-6qp7
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.
AnalysisAI
Secure Boot bypass on Microsoft Windows allows an authorized local attacker with high privileges to defeat a platform integrity protection mechanism, leading to compromise of confidentiality and integrity outside the original security boundary. The scope-changed CVSS 7.9 rating reflects that successful exploitation breaks out of the Secure Boot trust domain, though no public exploit is identified at time of analysis and the issue is not listed in CISA KEV. Microsoft (secure@microsoft.com) issued the advisory via MSRC, and the weakness is classified as improper access control (CWE-284).
Technical ContextAI
Secure Boot is a UEFI firmware feature that enforces a chain of trust at platform startup by validating bootloader and kernel signatures against keys stored in firmware variables (PK, KEK, db, dbx). CWE-284 (Improper Access Control) indicates the protection mechanism failure stems from inadequate enforcement of who or what may interact with a privileged resource - in this context, likely a boot-stage component, signed binary validation path, or a protected firmware/NVRAM interaction that should be gated behind Secure Boot policy. Because Secure Boot underpins downstream defenses such as BitLocker measured boot, Virtualization-Based Security (VBS), and Windows Defender System Guard, a bypass here undermines the root of trust on which those features rely. No specific CPE strings were provided in the intelligence set, so the precise affected Windows builds must be derived from the MSRC update guide.
RemediationAI
Apply the Microsoft security update referenced in MSRC advisory CVE-2026-45654 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45654) as soon as it is available for your Windows SKU and build; patch status from the supplied data is best described as patch available per vendor advisory, with no exact fix version independently confirmed in the intelligence set. Because the bypass requires PR:H, compensating controls until patching include restricting local administrative access through tiered admin models and LAPS, enabling and monitoring BitLocker plus Windows Defender System Guard so tampering with boot integrity raises measurable signals, and after deploying the update rotating the dbx (Secure Boot forbidden signature database) per Microsoft guidance to revoke any vulnerable boot components - note that dbx updates are one-way and can render unpatched dual-boot or recovery media unbootable, so test before broad rollout.
More in Windows 11 24h2
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Windows Shell contains a protection mechanism failure (CVE-2026-21510, CVSS 8.8) that allows unauthenticated remote atta
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptograph
Desktop Window Manager (DWM) in Windows contains a type confusion vulnerability (CVE-2026-21519, CVSS 7.8) that enables
Windows Common Log File System Driver contains another use-after-free for local privilege escalation, the latest in a se
Windows Storage contains an elevation of privilege vulnerability through symlink following that allows authorized attack
Windows Ancillary Function Driver for WinSock contains a use-after-free enabling local privilege escalation through a nu
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today