CVE Tools
Track your stack

Old UEFI Shims Expose Systems to Secure Boot Bypass

SecurityWeekBy Ionut Arghire

ResearchUEFI Shim bootloaderSecure Boot

Our summary

Researchers at ESET have identified nearly a dozen outdated UEFI shim bootloaders signed by Microsoft that could allow attackers to bypass Secure Boot protections. These shims, used to enable Linux distributions to boot securely, were not updated by some vendors and remained trusted despite known vulnerabilities. Microsoft revoked the affected shims on June 2026 Patch Tuesday, assigning them CVE identifiers CVE-2026-8863 and CVE-2026-10797. Attackers could exploit these flaws to execute malicious code during the boot process, undermining Secure Boot even when enabled.

Read at SecurityWeek

SecurityWeek publishes this story on its own site; we link to it rather than reprint it.

  1. The Hacker News11 Old Microsoft-Signed Linux UEFI Shims Could Let Attackers Bypass Secure BootCVE-2026-10797, CVE-2026-8863
  2. Help Net SecurityNo one knows how many old shims can still bypass UEFI Secure BootCVE-2026-10797, CVE-2026-8863
  3. ESET WeLiveSecurityForgotten UEFI shims undermining Secure BootCVE-2026-10797, CVE-2026-8863
  4. The Hacker NewsMicrosoft Patches Record 206 Flaws, Including Three Zero-Days and Critical RCE BugsCVE-2026-8863
  5. Rapid7 BlogRapid7CVE-2026-8863
  6. BleepingComputerMicrosoft June 2026 Patch Tuesday fixes 6 zero-days, 200 flawsCVE-2026-8863
  7. BleepingComputerMicrosoft June 2026 Patch Tuesday fixes 3 zero-day, 200 flawsCVE-2026-8863

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store