#ESETresearch discovered and reported to CERT Coordination Center (npub1vtv…56ng) 11 old Microsoft-signed UEFI shim bootloaders that allow bypassing UEFI Secure Boot on most UEFI systems. Read about it at https://www.welivesecurity.com/en/eset-research/forgotten-uefi-shims-undermining-secure-boot/
Tracked by #CVE-2026-8863 and #CVE-2026-10797, all these vulnerable shims were revoked in Microsoft’s June Patch Tuesday updates.
https://www.cve.org/CVERecord?id=CVE-2026-8863
https://www.cve.org/CVERecord?id=CVE-2026-10797
Exploiting these vulnerable shims allows execution of untrusted code at system boot by using the Bring Your Own Vulnerable Driver (#BYOVD) technique, enabling deployment of malicious UEFI bootkits on systems that trust the Microsoft Corporation UEFI CA 2011 certificate.
What makes these old shims dangerous is not a novel vulnerability, it’s that no new vulnerability is needed to bypass Secure Boot. Just an old, still-trusted, unrevoked shim and basic knowledge of how UEFI works is enough to bypass UEFI Secure Boot and deploy a UEFI bootkit.
For more details and instructions on how to verify that the dbx patches were properly applied on your system, read our blogpost:
https://www.welivesecurity.com/en/eset-research/forgotten-uefi-shims-undermining-secure-boot/
ESET Research
npub1ce…rp2g0
2026-07-14 09:18:50 UTC
Author Public Key
npub1cekh78scd0k4ps5yd579t0ktlkn4jv3fs9wmt427gpuaf5f26wwsgrp2g0Seen on
wss://relay.momostr.pinkPublished at
2026-07-14 09:18:50 UTCEvent JSON
{
"id": "67efde3f743eac434903185c4c2227272de085d14f9f5cf0d3f4d2cf27037ecb",
"pubkey": "c66d7f1e186bed50c2846d3c55becbfda7593229815db5d55e4079d4d12ad39d",
"created_at": 1784020730,
"kind": 1,
"tags": [
[
"t",
"esetresearch"
],
[
"p",
"62d862d2cfc23e425420aac8b1765c33ae354f65b7f7a764530363331533b99d"
],
[
"proxy",
"https://infosec.exchange/@ESETresearch/116917582564392811",
"web"
],
[
"t",
"cve"
],
[
"proxy",
"https://infosec.exchange/users/ESETresearch/statuses/116917582564392811",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/ESETresearch/statuses/116917582564392811",
"pink.momostr"
],
[
"-"
]
],
"content": "#ESETresearch discovered and reported to nostr:npub1vtvx95k0cglyy4pq4tytzajuxwhr2nm9klm6weznqd3nx9fnhxwsfn56ng 11 old Microsoft-signed UEFI shim bootloaders that allow bypassing UEFI Secure Boot on most UEFI systems. Read about it at https://www.welivesecurity.com/en/eset-research/forgotten-uefi-shims-undermining-secure-boot/ \nTracked by #CVE-2026-8863 and #CVE-2026-10797, all these vulnerable shims were revoked in Microsoft’s June Patch Tuesday updates. \n\nhttps://www.cve.org/CVERecord?id=CVE-2026-8863 \n\nhttps://www.cve.org/CVERecord?id=CVE-2026-10797\nExploiting these vulnerable shims allows execution of untrusted code at system boot by using the Bring Your Own Vulnerable Driver (#BYOVD) technique, enabling deployment of malicious UEFI bootkits on systems that trust the Microsoft Corporation UEFI CA 2011 certificate. \nWhat makes these old shims dangerous is not a novel vulnerability, it’s that no new vulnerability is needed to bypass Secure Boot. Just an old, still-trusted, unrevoked shim and basic knowledge of how UEFI works is enough to bypass UEFI Secure Boot and deploy a UEFI bootkit. \nFor more details and instructions on how to verify that the dbx patches were properly applied on your system, read our blogpost:\nhttps://www.welivesecurity.com/en/eset-research/forgotten-uefi-shims-undermining-secure-boot/",
"sig": "7602c58030b30dc8b4bac1a800f6f4e7d1671a5eaf0ff04c70032c6397098720c67dbcacda11f59bf99baa8b669ccb4888e9d29525bc4a4e39dc2a9c8f77567a"
}