Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-14 | 2 | Patch2 |
| 2026-07-15 | 1 | Patch1 |
| 2026-07-16 | 1 | Disclosure1 |
| 2026-07-22 | 1 | Patch1 |
Tracked by #CVE-2026-8863 and #CVE-2026-10797, all these vulnerable shims were revoked in Microsoft’s June Patch Tuesday updates. https://www.cve.org/CVERecord?id=CVE-2026-8863 https://www.cve.org/CVERecord?id=CVE-2026-10797 2/5
Post summary
Microsoft issued patches during June Patch Tuesday to address CVE‑2026‑8863 and CVE‑2026‑10797; no evidence of PoC, active exploitation, or detailed vulnerability description is presented.
11 forgotten, still-trusted UEFI shims (v0.9 and below) bypass Secure Boot on any system enrolling the Microsoft Corporation UEFI CA 2011 certificate. CVE-2026-8863 and CVE-2026-10797 assigned; revoked in Microsoft's June 9 2026 Patch Tuesday dbx update. - The core risk is not a novel bug: any attacker can copy a vulnerable, Microsoft-signed shim to the EFI System Partition of a target machine regardless of its installed OS, pair it with an old GRUB 2 binary, and execute unsigned code at boot, enabling bootkits like BlackLotus, Bootkitty, or HybridPetya. No memory corruption, no ROP chain required. - CVE-2026-10797 (shims v0.9 and below): the revocation check and signature verification functions read the signature length from different PE structures. An attacker manipulates the WIN_CERTIFICATE length field so dbx and MokListX comparisons run against garbage, silently bypassing certificate-based revocations for any shim-embedded certificate. - Pre-v15.3 shims ignore SBAT entirely; pre-v0.9 shims ignore MokListX. An enterprise that revoked a compromised MOK certificate via MokListX is fully exposed if an attacker substitutes one of these old shims, which trusts MokList but skips the denylist. - 11 PE Authenticode hashes were added to dbx on June 9 2026. Note: the expiration of Microsoft Corporation UEFI CA 2011 on June 27 2026 does NOT revoke trust in binaries it signed; certificate expiry has no effect on Secure Boot verification. #DFIR_Radar
Post summary
The post details how UEFI shims v0.9 and below bypass Secure Boot, explains the technical mechanics, and highlights the patch that revoked these CVEs.
🪲🪲🪲 Siber Güvenlik Zaafiyet Bülteni #SiberGüvenlik #GüvenlikBülteni Merhaba #Brolyz #Zafiyet: #Microsoft İmzalı Eski Linux UEFI Shim Bootloader'ları – Secure Boot Atlatma CVE: CVE-2026-8863, CVE-2026-10797 Zafiyet Türü: Secure Boot Bypass / Ayrıcalık Yükseltme Fidye Yazılımı Faaliyeti: Bilinmiyor 📌 Zafiyetin Özeti ESET araştırmacıları, Microsoft tarafından imzalanmış 11 eski Linux UEFI Shim Bootloader sürümünün UEFI Secure Boot mekanizmasını atlatmak için kullanılabileceğini açıkladı. Saldırganlar, hâlâ güvenilir kabul edilen eski shim dosyalarını kullanarak önyükleme aşamasında yetkisiz kod çalıştırabilir. Böylece Bootkitty, BlackLotus ve HybridPetya gibi UEFI bootkit'leri yüklenebilir ve işletim sistemi başlamadan önce kalıcılık sağlanabilir. 📌 Öne Çıkanlar 🔹 Microsoft imzalı 11 eski shim bootloader etkilendi. 🔹 Secure Boot koruması aşılabiliyor. 🔹 Zararlı kod, işletim sistemi yüklenmeden çalıştırılabiliyor. 🔹 EDR çözümleri devreye girmeden bootkit yüklenebiliyor. 🔹 BYOVD tekniğiyle istismar edilebiliyor. 🔹 Microsoft, etkilenen bootloader'ları Haziran 2026 güncellemesiyle iptal etti. 🛠️ Alınması Gereken Aksiyonlar ✅ Haziran 2026 ve sonraki güvenlik güncellemelerini yükleyin. ✅ Secure Boot DBX iptal listesinin güncel olduğundan emin olun. ✅ Eski shim bootloader'ları kaldırın. ✅ UEFI firmware ve Linux boot bileşenlerini güncelleyin. ✅ Önyükleme bileşenlerinde yetkisiz değişiklikleri izleyin. 📌 Not: Risk, yeni bir açıktan değil, eski ancak hâlâ güvenilen bootloader'ların kullanılabilmesinden kaynaklanıyor. Yerel yönetici yetkisi elde eden saldırganlar, işletim sistemi başlamadan önce kalıcı zararlı yazılım yerleştirebilir.
Post summary
The notice alerts about two CVEs that allow bypass of UEFI Secure Boot via old Microsoft‑signed shim bootloaders, details the vulnerability, and provides concrete patch and mitigation actions for affected systems.
CVE-2026-8863 and CVE-2026-10797 cover 11 Microsoft-signed UEFI shims (version 0.9 or below) that let attackers bypass Secure Boot and drop bootkits like BlackLotus. #DFIR_Radar https://t.co/VDI4Tvfzb0
Post summary
The tweet announces that CVE-2026-8863 and CVE-2026-10797 enable attackers to bypass Secure Boot on Microsoft UEFI shims and drop bootkits such as BlackLotus.
👉 ESET tracked this as CVE-2026-8863 and CVE-2026-10797, patched in the June 9 Patch Tuesday dbx update. The fix only works if you've applied it. How many boot images in your Linux fleet still trace back to a shim from three years ago?
Post summary
ESET identified CVE-2026-8863 and CVE-2026-10797, which were patched in the June 9 Patch Tuesday dbx update; the fix is effective only if the patch is applied.