Back Feeds.4Sysops

Microsoft revokes legacy UEFI shims to prevent Secure Boot bypasses

Feeds.4Sysops •IT News • July 15, 2026

Microsoft has revoked 11 legacy, Microsoft-signed UEFI shim bootloaders that allowed attackers to bypass Secure Boot protections. These outdated binaries, primarily version 0.9 and earlier, remained trusted by the "Microsoft Corporation UEFI CA 2011" certificate despite containing long-known vulnerabilities. By utilizing a "Bring Your Own Vulnerable Bootloader" (BYOVB) attack, threat actors could execute unauthorized code during the early boot phase before the operating system initializes. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Old UEFI Shims Exploit Bypass of Secure Boot Security ESET researchers have discovered 11 outdated UEFI shim bootloaders, all version 0.9 or below, that can bypass UEFI Secure Boot protections on systems trusting Microsoft's 2011 certificate. These vulnerabilities allow attackers to execute untrusted code during the boot process, enabling the deployment of UEFI bootkits like Bootkitty and BlackLotus. The shims were reported to CERT/CC in February 2026 and were revoked by Microsoft on June 9, 2026, under CVE-2026-8863 and CVE-2026-10797. The attack method relies on the 'bring your own vulnerable driver' technique, allowing exploitation regardless of the installed operating system. The vulnerabilities stem from outdated second-stage bootloaders, primarily GRUB 2, which contain known flaws. This situation affects various Linux distributions and software from major vendors, posing a significant risk to systems that have not updated their firmware. The lack of visibility into older shims complicates remediation efforts. 14 sources 71

Extracted Entities

Microsoft revokes legacy UEFI shims to prevent Secure Boot bypasses

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (2)