UEFI SHIM Bootloader EUVD-2026-35791

Patch availability is per-vendor: contact each affected product vendor (PC-Doctor, Spyrus, Blancco, Baramundi, the Finland Matriculation Board, NTC IT Rosa) for a SHIM build that ships and enforces correct SBAT metadata; specific patched versions beyond the upper-bound vulnerable versions listed in EUVD are not independently confirmed in the provided data. Track coordinated guidance via CERT/CC VU#616257 (https://kb.cert.org/vuls/id/616257) and Microsoft's CVE-2026-8863 advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-8863), and once vendor-released patches are confirmed apply them and then push the corresponding SBAT revocation update (e.g., via fwupd/LVFS or Windows servicing) so revoked SHIMs cannot be re-staged. Compensating controls while waiting for fixes: remove the vulnerable SHIM binaries (by authenticode hash) from imaging, recovery, and bootable-USB workflows; restrict physical and administrative access to the EFI System Partition and to USB boot on managed endpoints; enforce BIOS/UEFI admin passwords and disable booting from removable media in firmware - note that disabling USB boot will break legitimate imaging/diagnostic workflows for the very products listed, so coordinate with the teams that rely on PC-Doctor, WipeDrive, and Baramundi tooling.