11-Year-Old Linux UEFI Shim Bootloader Flaws Enable Secure Boot Bypass (CVE-2026-8863, CVE-2026-10797) — Threadlinqs Intelligence
As of 2026-07-14, 11-Year-Old Linux UEFI Shim Bootloader Flaws Enable Secure Boot Bypass (CVE-2026-8863, CVE-2026-10797) is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 19 indicators of compromise.
Threat ID: TL-2026-1340 · Severity: HIGH · CVSS: 7.8 · Status: ACTIVE · Category: VULNERABILITY
ESET Research identified 11 obsolete, still Microsoft-signed UEFI shim bootloaders (v0.9 and earlier) shipped by Red Hat, Oracle, openSUSE, Spyrus, Baramundi, WhiteCanyon/Blancco, Finland's
In February 2026, ESET researcher Martin Smolar reported to CERT/CC that 11 old UEFI shim bootloader binaries, all signed by the third-party 'Microsoft Corporation UEFI CA 2011' certificate authority and all at shim version 0.9 or earlier, remained fully trusted by any UEFI-based Secure Boot chain despite carrying long-known, already-patched-upstream vulnerabilities. The root cause is that downstream vendors forked shim years ago and never rebased onto fixed upstream releases, so their forked binaries kept shipping (and remaining trusted) with the flaws intact.
The technical crux, tracked as CVE-2026-10797, is a discrepancy in how an Authenticode-signed PE binary records its own signature length: once in the PE header's IMAGE_DIRECTORY_ENTRY_SECURITY data directory, and again inside the embedded WIN_CERTIFICATE structure. In the affected shim builds, the function that performs dbx/MokListX certificate-based revocation checks trusts the WIN_CERTIFICATE-embedded length, while the function that performs Authenticode signature verification trusts the PE header length. An attacker who tampers with the WIN_CERTIFICATE structure of a second-stage bootloader (e.g., GRUB 2) can steer the revocation-check routine toward the wrong byte range, so a certificate that has actually been revoked in dbx or MokListX is never recognized as revoked, while the separate signature-verification routine still validates the binary successfully using the correct, untampered bytes. This only works against certificate-based revocations (hash-based dbx entries are unaffected) and requires the second-stage loader to be signed by a certificate embedded in the shim's own trust chain.
CVE-2026-8863 covers the composite exploit chain: an attacker places one of the 11 legacimate, Microsoft-signed-but-vulnerable shim binaries plus an old, unpatched GRUB 2 build (itself carrying the decade-old CVE-2015-5281, which allows unsigned multiboot/multiboot2 kernel modules to be loaded without a signature check) onto a system's EFI System Partition. Firmware trusts and loads the old shim (it is still signed by a certificate in the system's `db`); the shim in turn validates GRUB 2 using its embedded vendor certificate; the revocation-check confusion above lets a revoked/malicious GRUB 2 pass; GRUB 2's multiboot2 loader then loads unsigned code with no further verification. The net effect is arbitrary code execution during the boot process on essentially any UEFI-based machine that trusts the Microsoft third-party CA, independent of which operating system (if any) is actually installed — this is functionally a 'Bring Your Own Vulnerable Driver' (BYOVD)-style attack applied to the boot chain rather than to a kernel driver.
Because execution happens before the OS kernel and any endpoint security agent initializes, a successful exploit can install a UEFI bootkit that persists across OS reinstalls and evades EDR/AV entirely — the same class of impact demonstrated by real-world bootkits Bootkitty (first UEFI bootkit targeting Linux), HybridPetya, and BlackLotus, all of which ESET cites as precedent. ESET deliberately withheld indicators of compromise, noting the vulnerable shims are embedded inside legitimate, widely distributed software packages (PC diagnostic tools, disk-wipe utilities, exam kiosk software, Linux installers) across an unknown number of systems, and publishing IOCs risked mass false-positive identification of benign, unexploited installations.
CERT/CC's VU#616257 enumerates confirmed-affected vendors: Spyrus WTGCreator (shim ≤0.7), Red Hat Enterprise Linux 7.2 and CentOS 7.2 (shim 0.9), Baramundi Management Suite up to 2024R1 (shim 0.8), WhiteCanyon/Blancco WipeDrive 8.0.0-8.1.3 (shim 0.7), Finland's Matriculation Examination Board's Abitti 1.0 exam software (shim 0.8), NTC IT ROSA Linux R9/R10 (shim 0.9), Oracle Linux 7.2 (shim 0.9), PC-Doctor Service Center 15/16 (shim 0.9), and openSUSE's UEFI shim loader 0.9/2.1. Intel and AMI confirmed their products do
Weaknesses (CWE)
CWE-347, CWE-354, CWE-706
Target sectors: government administration, education, technology, critical-infrastructure, manufacturing, all-sectors-uefi-based
Target regions: Global, North America, Europe, finland
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 19 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2026-8863, CVE-2026-10797, CVE-2015-5281, T1592, T1588.003, T1195, T1542.001, T1542.001, T1542.003, T1547, T1553.002, T1542.001, T1211