Old UEFI Shims Left Systems Vulnerable to Secure Boot Bypass Attacks
A disturbing discovery has been made in the world of cybersecurity, as a nearly decade-old vulnerability has been unearthed that allows attackers to bypass Secure Boot protections on systems. A group of old Unified Extensible Firmware Interface (UEFI) shim bootloaders, signed by Microsoft and used to bridge the gap between a computer’s motherboard firmware and operating system, have been found to be vulnerable to exploitation.
These UEFI shims are small pieces of software that enable Linux distributions to establish a trust model without requiring individual keys to be built into the motherboard’s Non-Volatile RAM (NVRAM). They allow bootloaders, kernels, and other components to run during Secure Boot, which is designed to prevent malware from loading during the boot process. However, it has been found that 11 old UEFI shims, primarily from version 0.9 and earlier, were not updated with security patches over time and remained signed and trusted within the Secure Boot chain.
The vulnerable shims could be exploited to bypass UEFI Secure Boot on any UEFI-based machine that trusts Microsoft’s third-party UEFI certificate authority (CA) certificate, regardless of the installed operating system. This means that attackers could execute untrusted code during the boot process and deploy malware even if Secure Boot is enabled. The fact that these old shims were still trusted by systems is particularly concerning, as it suggests that a significant portion of them may have been affected by numerous publicly known vulnerabilities over the years.
ESET discovered this vulnerability and reported it to CERT/CC in February 2026. Microsoft subsequently revoked all vulnerable applications and added them to the UEFI DBX (Forbidden Signature Database). System administrators are advised to update the signature database before applying revocations, which means updating trusted boot applications and certificates first, followed by deployment of the revocation list.
This vulnerability serves as a reminder that even seemingly secure systems can be compromised if not properly maintained. The fact that these old UEFI shims remained trusted for so long highlights the importance of regular security updates and patching. Enterprises, virtualization providers, and cloud operators managing large-scale deployments should prioritize validation and deployment of these updates to prevent the execution of vulnerable or unsigned binaries during physical or virtual machine startup.
In practical terms, this vulnerability emphasizes the need for system administrators to regularly review and update their trusted boot applications and certificates. This includes verifying that all UEFI shims are up-to-date and not affected by known vulnerabilities. By taking proactive measures to secure their systems, organizations can minimize the risk of being targeted by attackers who exploit these types of vulnerabilities.
Source: SecurityWeek — 2026-07-16