[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f42eB-kwMM5xIdJqjGmW7Y3Cfg5yoxjKx3HUdhwAmYLA":3},{"article":4,"iocs":38,"watch_terms":48,"solutions":49,"lesson":131},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"64f92c42-e3f7-493e-8744-edfc34a7f7db","Old UEFI Shims Expose Systems to Secure Boot Bypass","old-uefi-shims-expose-systems-to-secure-boot-bypass-1b9ed6","Signed by Microsoft, the vulnerable UEFI shim bootloaders could be abused on any system, regardless of the OS. The post Old UEFI Shims Expose Systems to Secure Boot Bypass appeared first on SecurityWeek.","ESET discovered 11 old, Microsoft-signed UEFI shim bootloaders (primarily version 0.9 and earlier) that can be exploited to bypass Secure Boot protections on any UEFI-based system. The vulnerable shims remained trusted despite known vulnerabilities and were only revoked by Microsoft in June 2026. Attackers could use these shims to execute untrusted code during boot and deploy bootkits regardless of Secure Boot enablement.","Microsoft-signed UEFI shim bootloaders allow Secure Boot bypass on any UEFI system.","https:\u002F\u002Fwww.securityweek.com\u002Fold-uefi-shims-expose-systems-to-secure-boot-bypass\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F06\u002FUEFI-chip-BIOS.jpeg","2026-07-16T07:59:22+00:00","2026-07-16T08:00:18.147136+00:00",9,[17,20,22,25,27,30],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":19},"ESET",{"name":23,"type":24},"UEFI","technology",{"name":26,"type":24},"Secure Boot",{"name":28,"type":29},"GRUB2","product",{"name":31,"type":24},"UEFI DBX","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[],[39,43,45],{"type":40,"value":41,"context":42},"cve","CVE-2026-8863","UEFI shim Secure Boot bypass vulnerability",{"type":40,"value":44,"context":42},"CVE-2026-10797",{"type":40,"value":46,"context":47},"CVE-2020-10713","BootHole vulnerability affecting GRUB2, mentioned as example of vulnerabilities in old shims",[18,21,28],{"controls":50,"vendors":122},[51,80,108],{"slug":52,"name":53,"problem":54,"products":55},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":81,"name":82,"problem":83,"products":84},"patch-management","Automated patch management","Known holes get closed in days, not months.",[85,93,100],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":94,"vendor_name":18,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":109,"name":110,"problem":111,"products":112},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[113,114],{"vendor_slug":94,"vendor_name":18,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[123,128],{"slug":124,"name":21,"logo_path":125,"roles":126},"eset","\u002Fvendor-logos\u002Feset.png",[127],"reported_by",{"slug":94,"name":18,"logo_path":95,"roles":129},[130],"affected",{"slug":132,"title":133,"body":134,"framework_refs":135,"framework_notes":146},"unrevoked-uefi-shims-enable-secure-boot-bypass-via-trusted-but-vulnerable-bootloaders","Unrevoked UEFI Shims Enable Secure Boot Bypass via Trusted-but-Vulnerable Bootloaders","Microsoft-signed UEFI shim bootloaders from version 0.9 and earlier remained trusted in the Secure Boot ecosystem for years despite containing known exploitable vulnerabilities, allowing attackers to bypass one of the foundational firmware-level security controls in modern systems. The core failure was the delayed revocation of these signed shims — trust was not rescinded until June 2026, leaving a wide window of exposure. This matters because Secure Boot is designed to be a hardware-anchored root of trust; when signed artifacts are not promptly revoked after vulnerabilities are discovered, the entire chain of trust is undermined. Bootkits installed via this vector are especially dangerous as they execute before the operating system loads, making them invisible to most endpoint security tools and extremely difficult to remove.",[136,137,138,139,140,141,142,143,144,145],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets","NIST SP 800-147: BIOS Protection Guidelines","NIST SP 800-193: Platform Firmware Resiliency Guidelines","NIST CM-6: Configuration Settings","NIST SI-2: Flaw Remediation","NIST RA-5: Vulnerability Monitoring and Scanning","ITIL Change Management: Emergency Change Procedures","UEFI Forum Secure Boot Specification: DBX Revocation List Management",{}]