CVE-2026-8863: exploitation status and patch state

CVE-2026-8863 · CVSS 7.8 HIGH · EPSS <1% · patch available

Multiple Microsoft-sigend UEFI SHIM bootloaders are vulnerable to SecureBoot bypass. An attacker with administrative privileges or the ability to modify the boot process could use one of the vulnerable shim bootloaders to bypass Secure Boot protections and execute arbitrary code before the operating system loads. Specific UEFI DBX update is required to block these vulnerable boot loaders.

Is CVE-2026-8863 exploited?

• Not in the CISA KEV catalog.
• EPSS puts exploitation in the next 30 days at <1%.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

No affected package list recorded here yet.

Is there a patch?

• KB5094123
• KB5094128
• KB5094127
• KB5094126
• KB5094125
• KB5093998
• KB5095051
• KB5094122
• KB5094042
• KB5094041

What PlainSec published about CVE-2026-8863

• Legacy Shim Revocations Leave Secure Boot Gaps (2026-07-17)

Primary sources

• NVD record
• Microsoft KB5094123
• Microsoft KB5094128
• Microsoft KB5094127
• Microsoft KB5094126
• Microsoft KB5094125
• Microsoft KB5093998
• Microsoft KB5095051
• Microsoft KB5094122
• Microsoft KB5094042

What this record does not say

• No affected package data.

KEV and EPSS are re-checked daily. Record last updated 2026-08-11.