Vulnerabilities & Exploits · Supply Chain

Legacy Shim Revocations Leave Secure Boot Gaps

Secure Boot only holds here if every old Microsoft-signed shim has been revoked, and that inventory is incomplete. That means a machine can still accept a trusted first-stage loader that was never shipped with the PC, then hand control to an older second-stage loader that admits unsigned code.

ESET identified eleven Microsoft-signed shim versions at 0.9 or below that bypass UEFI Secure Boot. Microsoft revoked them on June 9, 2026, but the signing history is incomplete, so the remaining exposure is unknown; the risk reaches any UEFI system that trusts the Microsoft Corporation UEFI CA 2011, including systems that never installed the vulnerable shim themselves.

The broken assumption is simple: 'Secure Boot enabled' does not equal 'boot path protected' if a legacy shim is still reachable. That makes historical shim inventory and revocation coverage part of the control itself, not just patch hygiene.

7 sources · Jul 16

CVE-2026-8863

NVD KEV

CVSS 7.8 HIGH: multiple Microsoft-sigend UEFI SHIM bootloaders are vulnerable to SecureBoot bypass. EPSS 0.1% (1st percentile). Microsoft patch: 5094123.

Patch available KB5094123 Download →

Timeline

Jul 16 Reported by SecurityWeek
Jul 15 Reported by Dark Reading
Jul 15 Reported by Ars Technica Security

Sources

Jul 16 SecurityWeek
Old UEFI Shims Expose Systems to Secure Boot Bypass
Signed by Microsoft, the vulnerable UEFI shim bootloaders could be abused on any system, regardless of the OS.
original
Jul 15 Dark Reading
Forgotten Bootloaders Expose Secure Boot Blind Spot
Nearly a dozen vulnerable and now revoked UEFI shim bootloaders remained trusted for years, giving attackers a path to bypass Secure Boot.
original
Jul 15 Infosecurity Magazine
Eleven Vulnerable UEFI Shims Enable Secure Boot Bypass
Eleven forgotten Microsoft-signed UEFI shims can bypass Secure Boot on almost any machine
original

Vendor digest: Microsoft

Part of the PlainSec briefing for 2026-07-16

Every edition of this story: Legacy Shim Revocations Leave Secure Boot Gaps

More from today

Vulnerabilities & Exploits · Supply ChainLegacy Shim Revocations Leave Secure Boot GapsSecure Boot only holds here if every old Microsoft-signed shim has been revoked, and that inventory is incomplete. That means a machine can still accept a trusted first-stage loader that was never shipped with the PC, then hand control to an older second-stage loader that admits unsigned code.ESET identified eleven Microsoft-signed shim versions at 0.9 or below that bypass UEFI Secure Boot. Microsoft revoked them on June 9, 2026, but the signing history is incomplete, so the remaining exposure is unknown; the risk reaches any UEFI system that trusts the Microsoft Corporation UEFI CA 2011, including systems that never installed the vulnerable shim themselves.The broken assumption is simple: 'Secure Boot enabled' does not equal 'boot path protected' if a legacy shim is still reachable. That makes historical shim inventory and revocation coverage part of the control itself, not just patch hygiene.7 sources · Jul 16

CVE-2026-8863

NVD KEV

CVSS 7.8 HIGH: multiple Microsoft-sigend UEFI SHIM bootloaders are vulnerable to SecureBoot bypass. EPSS 0.1% (1st percentile). Microsoft patch: 5094123.

Patch available KB5094123 Download →

Timeline

Jul 16 Reported by SecurityWeek

Jul 15 Reported by Dark Reading

Jul 15 Reported by Ars Technica Security

Sources

Jul 16 SecurityWeek

Old UEFI Shims Expose Systems to Secure Boot Bypass

Signed by Microsoft, the vulnerable UEFI shim bootloaders could be abused on any system, regardless of the OS.

original

Jul 15 Dark Reading

Forgotten Bootloaders Expose Secure Boot Blind Spot

Nearly a dozen vulnerable and now revoked UEFI shim bootloaders remained trusted for years, giving attackers a path to bypass Secure Boot.

original

Jul 15 Infosecurity Magazine

Eleven Vulnerable UEFI Shims Enable Secure Boot Bypass

Eleven forgotten Microsoft-signed UEFI shims can bypass Secure Boot on almost any machine

original

Vendor digest: MicrosoftPart of the PlainSec briefing for 2026-07-16Every edition of this story: Legacy Shim Revocations Leave Secure Boot GapsMore from today

AsyncAPI Imports Now Trigger Malware at Load Time

Gold Eagle Makes Vulnerability Triage a Federal Pipeline

AI Pipeline Shortens the Path to Exploits