Forgotten UEFI Shims Undermine Secure Boot (CVE-2026-8863, CVE-2026-10797) — Threadlinqs Intelligence
As of 2026-07-14, Forgotten UEFI Shims Undermine Secure Boot (CVE-2026-8863, CVE-2026-10797) is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 17 indicators of compromise.
Threat ID: TL-2026-1298 · Severity: HIGH · CVSS: 7.8 · Status: PATCHED · Category: VULNERABILITY
ESET researchers identified 11 Microsoft-signed UEFI shim bootloader versions (0.9 and below, signed 2013-2025) that fail to enforce the MOK denylist (MokListX) and allow WIN_CERTIFICATE structure
In February 2026, ESET researchers reported to CERT/CC a set of Secure Boot bypass vulnerabilities affecting Microsoft-signed UEFI shim bootloaders. The shim project is a small, Microsoft-signed bridge binary that allows Linux distributions and other non-Microsoft software to chain-load a second-stage bootloader (typically GRUB2) on systems with UEFI Secure Boot enabled, without requiring each vendor's key to be embedded directly in firmware. Because shim is Microsoft-signed against the widely deployed 'Microsoft Corporation UEFI CA 2011' certificate, any shim binary bearing a valid signature under that CA is trusted by virtually every Secure-Boot-enabled PC shipped since 2012.
Over the shim project's lifetime, numerous vendors forked or vendored older shim releases (version 0.9 and earlier) into their own products -- PC diagnostic and recovery tools, disk-wipe utilities, enterprise management agents, Linux distribution installers, and exam/kiosk software -- without tracking upstream security fixes. ESET catalogued 11 distinct Microsoft-signed shim binaries, signed between 2013 and 2025, that remained deployable and trusted despite carrying multiple unpatched weaknesses:
1. Missing MokListX (MOK denylist) enforcement -- shims at or below version 0.9 predate the MokListX revocation feature entirely, so even though a victim machine's MokList (allow-list) may be current, the shim silently ignores any certificate-based deny entries pushed via MokListX. An attacker can therefore replace an up-to-date shim on the ESP with one of these old, still-validly-signed shims and have it re-trust certificates that the system owner explicitly revoked.
2. WIN_CERTIFICATE structure tampering (CVE-2026-10797) -- a signed PE (portable executable) binary's Authenticode signature records its length in two separate places in the image. The affected shims read one length field when performing the revocation/denylist comparison and the other length field when performing cryptographic signature verification. By crafting a WIN_CERTIFICATE structure where these two fields diverge, an attacker can make the revocation-check code compare against bogus padding data instead of the bootloader's real signature, causing certificate-based dbx/MokListX revocations to silently fail to match while the binary still verifies and boots. This bypass is scoped to certificate-based revocation entries; hash-based (Authenticode thumbprint) dbx entries are unaffected by CVE-2026-10797 itself, which is why Microsoft's June 9 remediation revokes the vulnerable shims by their PE Authenticode hash directly.
3. Absent SBAT (Secure Boot Advanced Targeting) awareness -- shims prior to upstream version 15.3 do not parse the .sbat PE section or evaluate the SbatLevel UEFI variable at all. SBAT was introduced specifically to allow fine-grained, per-component revocation of vulnerable second-stage loaders (e.g., GRUB2) without having to blacklist entire shim binaries by hash. A pre-15.3 shim will happily chain-load an SBAT-revoked GRUB2 build, reopening previously patched GRUB2 vulnerabilities.
4. Chaining to a known-vulnerable second-stage loader -- as a concrete demonstration, ESET showed that the Oracle Linux 7.1 installation media shim will trust and chain-load a bundled GRUB2 binary that is vulnerable to CVE-2015-5281, a decade-old flaw that lets an attacker supply a crafted multiboot/multiboot2 kernel module to execute unverified code, fully defeating Secure Boot's chain of trust.
Exploitation requires the attacker to place one of the vulnerable, still-Microsoft-signed shim binaries (and, where relevant, a matching vulnerable second-stage loader or crafted multiboot image) onto the target's EFI System Partition. This requires either local administrator/root privileges on a running system, or physical/console access sufficient to write to the ESP (e.g., booting from removable media or through a management-agent supply chain such as Baramundi or WipeDrive images). No remote net
Weaknesses (CWE)
CWE-1329, CWE-347, CWE-345, CWE-807
Target sectors: government administration, education, technology, manufacturing, critical-infrastructure, enterprise-it
Target regions: Global, North America, Europe, finland
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 17 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2026-8863, CVE-2026-10797, CVE-2015-5281, T1195, T1091, T1542.001, T1542, T1542.003, T1542, T1542, T1542.003, T1553, T1553.002