11-year-old Microsoft-signed UEFI shim bootloaders, some dating back over a decade, let attackers completely bypass UEFI Secure Boot on nearly any UEFI-based machine, regardless of the installed operating system.
ESET researchers uncovered that the vulnerable shims, all at version 0.9 or earlier, were signed by Microsoft’s “Microsoft Corporation UEFI CA 2011” certificate and remained trusted for years despite carrying known, exploitable flaws.
Attackers exploiting these shims can execute untrusted code during the boot process, opening the door to deploying malicious UEFI bootkits such as Bootkitty, HybridPetya, or BlackLotus even on systems where Secure Boot is fully enabled.
Crucially, this isn’t limited to devices running the affected software or Linux distribution; an attacker can simply bring their own copy of a vulnerable shim to any machine that trusts Microsoft’s third-party UEFI certificate.
11-Year-Old Linux UEFI Shim Bootloaders
Shim bootloaders act as a trusted first-stage component that Microsoft signs once, allowing Linux distributions to boot under Secure Boot without needing individual vendor keys embedded in every motherboard.
The shim then hands off trust to a second-stage bootloader, typically GRUB 2, via vendor-managed certificates. The problem is that many of these old shims lack modern anti-revocation protections, including proper enforcement of the Machine Owner Key denylist (MokListX) and Secure Boot Advanced Targeting (SBAT), both introduced well after these binaries were signed.
This means attackers can pair an ancient shim with a separately revoked or vulnerable GRUB 2 binary and the shim simply won’t know to reject it.
Exploitation resembles a Bring Your Own Vulnerable Driver (BYOVD)-style attack, since the malicious pair of files can be dropped directly onto the EFI System Partition and executed before the operating system even loads.
Two CVE identifiers were assigned to formally track the issue.
| CVE ID | Focus |
|---|---|
| CVE-2026-8863 | Covers the primary shim-bypass issue reported to CERT/CC. |
| CVE-2026-10797 | Covers a decade-old revocation-check flaw where the shim reads signature size from the wrong PE structure, letting attackers dodge dbx/MokListX revocation entirely |
CERT/CC’s official vulnerability note confirms the affected shims stem primarily from version 0.9 and earlier of the open-source shim project, spanning PC-diagnostics tools, Linux distributions, and other UEFI utilities.
ESET reported its findings to CERT/CC in February 2026, and after coordination delays, Microsoft revoked all 11 vulnerable shim binaries via a dbx update rolled out on the June 9th, 2026 Patch Tuesday.
Once the update lands, Secure Boot firmware will refuse to load any of the flagged shim versions by checking their SHA-256 Authenticode hashes against the forbidden signature database.
Notably, all UEFI systems with Microsoft’s third-party UEFI signing enabled are exposed, though Windows 11 Secured-core PCs have that option disabled by default, offering some built-in protection.
Tips for Defenders
Security teams and end users should apply the patch carefully to avoid boot failures.
- Deploy the updated authorized signature database (db) first, then apply the dbx revocation list — reversing this order can cause systems to reject legitimate signed bootloaders.
- Windows systems should receive the dbx update automatically through Patch Tuesday channels.
- Linux users should check for updates via the Linux Vendor Firmware Service and verify revocation status with the uefi-dbx-audit script.
- Enterprises should test the update on non-critical hardware before broad rollout, since improper deployment order can leave systems unbootable.
- Administrators can also use PowerShell audit scripts to confirm the necessary SHA-256 hashes are present in their dbx variable.
This case underscores a persistent visibility problem in the UEFI signing ecosystem: many shims signed before 2017, when the shim-review transparency process began, remain unaccounted for, meaning more forgotten, exploitable binaries could still be trusted on systems worldwide.
