CVE-2026-8863Disclosure

ESETの研究者が、Microsoft署名付きのUEFI shimブートローダー11件により、長年Secure Bootを回避できる状態が続いていたことを公表した。Microsoftは対象バイナリを失効させ、問題はVU#616257、CVE-2026-8863、CVE-2026-10797として追跡されている。 問題となったshimは、MicrosoftのUEFI証明書で署名された第1段階ブートローダーで、GRUB 2など次のブートコンポーネントを検証して起動を引き継ぐ役割を持つ。対象はRed Hat Enterprise Linux 7.2、CentOS 7.2、Oracle Linux 7.2、openSUSE、Baramundi Management Suite、WhiteCanyon WipeDrive、Abittiなどに含まれていた。 影響を受けたshimには、既知のGRUB 2の脆弱性CVE-2015-5281を利用可能なもの、SBATを実装していないもの、署名検証時に証明書長を異なる場所から読み取る実装不備を持つものが含まれていた。この不備により、証明書構造を改変した悪意あるバイナリが検証を通過できるという。 Secure Bootはshimの署名のみを検証するため、対象製品を使用していないPCでも、署名済みshimをUSBメモリやEFIパーティションへ配置すれば悪用できる可能性があった。Microsoftは2026年6月の更新でDBXを配布し、11件のshimを失効させた。CERT/CCは、DBX適用前にDBを更新しないと起動不能になる可能性があると注意を促している。現時点で悪用の証拠は確認されていない。 冒頭文字数: 119 全文文字数: 480

Microsoft署名のshim UEFIブートローダー(OSS)にセキュアブート回避の脆弱性。バージョン0.9以前に影響。ブートの早期段階でBYOVD的な攻撃が可能で、当然EDRの完全回避が可能。CVE-2026-8863。 https://securityonline.info/vulnerable-uefi-shim-bootloaders/

Tracked by #CVE-2026-8863 and #CVE-2026-10797, all these vulnerable shims were revoked in Microsoft’s June Patch Tuesday updates. https://www.cve.org/CVERecord?id=CVE-2026-8863 https://www.cve.org/CVERecord?id=CVE-2026-10797 2/5

11 forgotten, still-trusted UEFI shims (v0.9 and below) bypass Secure Boot on any system enrolling the Microsoft Corporation UEFI CA 2011 certificate. CVE-2026-8863 and CVE-2026-10797 assigned; revoked in Microsoft's June 9 2026 Patch Tuesday dbx update. - The core risk is not a novel bug: any attacker can copy a vulnerable, Microsoft-signed shim to the EFI System Partition of a target machine regardless of its installed OS, pair it with an old GRUB 2 binary, and execute unsigned code at boot, enabling bootkits like BlackLotus, Bootkitty, or HybridPetya. No memory corruption, no ROP chain required. - CVE-2026-10797 (shims v0.9 and below): the revocation check and signature verification functions read the signature length from different PE structures. An attacker manipulates the WIN_CERTIFICATE length field so dbx and MokListX comparisons run against garbage, silently bypassing certificate-based revocations for any shim-embedded certificate. - Pre-v15.3 shims ignore SBAT entirely; pre-v0.9 shims ignore MokListX. An enterprise that revoked a compromised MOK certificate via MokListX is fully exposed if an attacker substitutes one of these old shims, which trusts MokList but skips the denylist. - 11 PE Authenticode hashes were added to dbx on June 9 2026. Note: the expiration of Microsoft Corporation UEFI CA 2011 on June 27 2026 does NOT revoke trust in binaries it signed; certificate expiry has no effect on Secure Boot verification. #DFIR_Radar

🪲🪲🪲 Siber Güvenlik Zaafiyet Bülteni #SiberGüvenlik #GüvenlikBülteni Merhaba #Brolyz #Zafiyet: #Microsoft İmzalı Eski Linux UEFI Shim Bootloader'ları – Secure Boot Atlatma CVE: CVE-2026-8863, CVE-2026-10797 Zafiyet Türü: Secure Boot Bypass / Ayrıcalık Yükseltme Fidye Yazılımı Faaliyeti: Bilinmiyor 📌 Zafiyetin Özeti ESET araştırmacıları, Microsoft tarafından imzalanmış 11 eski Linux UEFI Shim Bootloader sürümünün UEFI Secure Boot mekanizmasını atlatmak için kullanılabileceğini açıkladı. Saldırganlar, hâlâ güvenilir kabul edilen eski shim dosyalarını kullanarak önyükleme aşamasında yetkisiz kod çalıştırabilir. Böylece Bootkitty, BlackLotus ve HybridPetya gibi UEFI bootkit'leri yüklenebilir ve işletim sistemi başlamadan önce kalıcılık sağlanabilir. 📌 Öne Çıkanlar 🔹 Microsoft imzalı 11 eski shim bootloader etkilendi. 🔹 Secure Boot koruması aşılabiliyor. 🔹 Zararlı kod, işletim sistemi yüklenmeden çalıştırılabiliyor. 🔹 EDR çözümleri devreye girmeden bootkit yüklenebiliyor. 🔹 BYOVD tekniğiyle istismar edilebiliyor. 🔹 Microsoft, etkilenen bootloader'ları Haziran 2026 güncellemesiyle iptal etti. 🛠️ Alınması Gereken Aksiyonlar ✅ Haziran 2026 ve sonraki güvenlik güncellemelerini yükleyin. ✅ Secure Boot DBX iptal listesinin güncel olduğundan emin olun. ✅ Eski shim bootloader'ları kaldırın. ✅ UEFI firmware ve Linux boot bileşenlerini güncelleyin. ✅ Önyükleme bileşenlerinde yetkisiz değişiklikleri izleyin. 📌 Not: Risk, yeni bir açıktan değil, eski ancak hâlâ güvenilen bootloader'ların kullanılabilmesinden kaynaklanıyor. Yerel yönetici yetkisi elde eden saldırganlar, işletim sistemi başlamadan önce kalıcı zararlı yazılım yerleştirebilir.

⚠️ Vulnerabilidad en componente UEFI ❗ CVE-2026-8863 ➡️ Más info: https://www.cert.gov.py/vulnerabilidad-en-componente-uefi/ https://t.co/8Z5BssOzBw

CVE-2026-8863 and CVE-2026-10797 cover 11 Microsoft-signed UEFI shims (version 0.9 or below) that let attackers bypass Secure Boot and drop bootkits like BlackLotus. #DFIR_Radar https://t.co/VDI4Tvfzb0

CVE-2026-8863: UEFI Secure Boot Bypass - What It Means for Your Business and How to Respond https://hubs.li/Q04tXsCX0

👉 ESET tracked this as CVE-2026-8863 and CVE-2026-10797, patched in the June 9 Patch Tuesday dbx update. The fix only works if you've applied it. How many boot images in your Linux fleet still trace back to a shim from three years ago?

TRC analysis shows attackers exploiting outdated Microsoft-signed UEFI shims to bypass Secure Boot protections, deploying malicious bootkits at the firmware level. CVE-2026-8863 enables untrusted code execution during system startup, escalating privileges before the OS loads. #ZeroDay #CloudSecurity 🔗 Full breakdown: https://aviatrix.ai/threat-research-center/11-old-microsoft-signed-linux-uefi-shims-cve-2026-8863

🪟 Secure Boot bypass CVE isn’t “just another patch” — it pokes the trust chain right before Windows boots. Microsoft confirming the bug without the fireworks? Smart, and still scary. https://windowsforum.com/threads/cve-2026-8863-secure-boot-bypass-what-it-means-for-windows-boot-trust.424383/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #WindowsSecurity #SecureBoot #UefiVulnerability #CertificateMigration https://t.co/zanqGYyrRa