Fast Facts
- Attackers can exploit outdated, Microsoft-signed UEFI shim bootloaders to bypass Secure Boot, enabling malicious code execution during system startup.
- Vulnerable shim versions allow bypassing revocation mechanisms (MOK denylist, SBAT), risking persistent malware that survives OS reinstallation or reboots.
- Malicious actors with admin privileges can leverage these vulnerabilities to inject bootkits, evade detection, and establish persistent control before security or OS defenses activate.
Threat Overview, Attack Techniques, and Targets
Cybersecurity experts have identified 11 outdated, Microsoft-signed UEFI shim applications that can be exploited to bypass Secure Boot. These old shim bootloaders trust Microsoft’s “Microsoft Corporation UEFI CA 2011” certificate, even after it expired in June 2026. Since Secure Boot relies on verifying signatures, attackers can use these vulnerabilities to load untrusted code during system startup. This allows malicious programs like UEFI bootkits to run before the operating system loads.
Attackers exploit the fact that older shim versions, such as those from version 0.7 or earlier, are still trusted. They can replace a legitimate shim with an older, trusted one. This bypasses security measures and permits malware to take control early in the boot process. Common targets include Linux systems and devices that use specific open-source shims, management software, or Linux distributions. Because the vulnerabilities exist before the OS fully loads, they are especially dangerous.
The attack sequence involves the firmware loading the shim and validating it with Microsoft’s expired certificate. The shim then validates the second-stage bootloader, such as GRUB 2, which in turn validates the kernel. Exploiting these trust relationships allows malicious actors to run harmful code silently during system startup.
Impact, Security Implications, and Remediation Guidance
The main impact of these vulnerabilities is that attackers can bypass Secure Boot protections. They can execute malicious code before the operating system starts, making it difficult to detect or remove. This can result in deeply embedded malware that survives reboots and reinstallation of the OS.
The security implications are serious because malicious code can run early and stay persistent. It also subverts mechanisms like Secure Boot Advanced Targeting (SBAT), which is designed to revoke compromised boot components. Vulnerable shim loaders remain trusted because they are not revoked through Microsoft’s DBX list. As a result, systems remain at risk for long periods.
Because this issue involves unpatched and old-shim binaries, remediation should be obtained directly from the vendor or security authorities. The affected shim versions were revoked by Microsoft in June 2026. Users should update to the latest bootloaders and check for patches from their device manufacturers or Linux distributions. It is important to follow guidance from trusted security vendors or official sources to mitigate these vulnerabilities effectively.
Expand Your Tech Knowledge
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Explore past and present digital transformations on the Internet Archive.
ThreatIntel-V1
