Back Feeds.4Sysops

Vulnerable UEFI shims allow attackers to bypass Secure Boot protections

Feeds.4Sysops •IT News • July 14, 2026

Researchers have identified at least eleven vulnerable UEFI shim bootloaders that allow attackers to bypass Secure Boot on any system trusting the Microsoft third-party certificate authority. These shims, primarily version 0.9 or older, act as a bridge between firmware and the operating system but contain decade-old flaws that can be exploited to execute unsigned code. Because attackers can simply bring their own copy of a trusted but vulnerable binary to a target machine, the protection is undermined regardless of the installed operating system. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Old UEFI Shims Exploit Bypass of Secure Boot Security ESET researchers have discovered 11 outdated UEFI shim bootloaders, all version 0.9 or below, that can bypass UEFI Secure Boot protections on systems trusting Microsoft's 2011 certificate. These vulnerabilities allow attackers to execute untrusted code during the boot process, enabling the deployment of UEFI bootkits like Bootkitty and BlackLotus. The shims were reported to CERT/CC in February 2026 and were revoked by Microsoft on June 9, 2026, under CVE-2026-8863 and CVE-2026-10797. The attack method relies on the 'bring your own vulnerable driver' technique, allowing exploitation regardless of the installed operating system. The vulnerabilities stem from outdated second-stage bootloaders, primarily GRUB 2, which contain known flaws. This situation affects various Linux distributions and software from major vendors, posing a significant risk to systems that have not updated their firmware. The lack of visibility into older shims complicates remediation efforts. 10 sources 71

Extracted Entities

Platforms (1)

UEFI