11-Year-Old Linux UEFI Shim Bootloader Flaws Enable Secure Boot Bypass (CVE-2026-8863, CVE-2026-10797)
11-Year-Old Linux UEFI Shim Bootloader Flaws Enable Secure (TL-2026-1340), also tracked as Forgotten UEFI Shims, is a high-severity software vulnerability scored CVSS 7.8, first published 2026-07-14. It has no confirmed attribution, affects Spyrus WTGCreator, references 3 CVEs (CVE-2026-8863, CVE-2026-10797, CVE-2015-5281), maps to 15 MITRE ATT&CK techniques (T1014, T1082, T1195), and is covered by 9 detection rules and 19 indicators of compromise.
Key facts for TL-2026-1340
- Threat ID
- TL-2026-1340
- Also known as
- Forgotten UEFI Shims, Shim Secure Boot Bypass 2026
- Severity
- HIGH
- CVSS
- 7.8 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-07-14
- Last reviewed
- 2026-07-14
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, education, technology, critical-infrastructure, manufacturing, all-sectors-uefi-based
- Target regions
- Global, North America, Europe, finland
- Detection rules
- 9
- Indicators of compromise
- 19
Malware and tooling in 11-Year-Old Linux UEFI Shim Bootloader Flaws Enable Secure
Malware and tooling: BlackLotus, Bootkitty, HybridPetya
ESET Research identified 11 obsolete, still Microsoft-signed UEFI shim bootloaders (v0.9 and earlier) shipped by Red Hat, Oracle, openSUSE, Spyrus, Baramundi, WhiteCanyon/Blancco, Finland's Matriculation Examination Board, NTC IT ROSA, and PC-Doctor that let an attacker bypass UEFI Secure Boot and execute untrusted code during system boot. CVE-2026-10797 is a signature-length confusion between the PE header and WIN_CERTIFICATE structure that lets a certificate revoked in dbx/MokListX slip past the shim's revocation check; CVE-2026-8863 covers the related shim-side bypass paired with old, unrestricted GRUB 2 (CVE-2015-5281) multiboot2 loading to achieve arbitrary unsigned code execution. Microsoft revoked all 11 vulnerable shim hashes via a dbx update on the June 9, 2026 Patch Tuesday after ESET's February 2026 disclosure to CERT/CC.
How 11-Year-Old Linux UEFI Shim Bootloader Flaws Enable Secure works
In February 2026, ESET researcher Martin Smolar reported to CERT/CC that 11 old UEFI shim bootloader binaries, all signed by the third-party 'Microsoft Corporation UEFI CA 2011' certificate authority and all at shim version 0.9 or earlier, remained fully trusted by any UEFI-based Secure Boot chain despite carrying long-known, already-patched-upstream vulnerabilities. The root cause is that downstream vendors forked shim years ago and never rebased onto fixed upstream releases, so their forked binaries kept shipping (and remaining trusted) with the flaws intact.
The technical crux, tracked as CVE-2026-10797, is a discrepancy in how an Authenticode-signed PE binary records its own signature length: once in the PE header's IMAGE_DIRECTORY_ENTRY_SECURITY data directory, and again inside the embedded WIN_CERTIFICATE structure. In the affected shim builds, the function that performs dbx/MokListX certificate-based revocation checks trusts the WIN_CERTIFICATE-embedded length, while the function that performs Authenticode signature verification trusts the PE header length. An attacker who tampers with the WIN_CERTIFICATE structure of a second-stage bootloader (e.g., GRUB 2) can steer the revocation-check routine toward the wrong byte range, so a certificate that has actually been revoked in dbx or MokListX is never recognized as revoked, while the separate signature-verification routine still validates the binary successfully using the correct, untampered bytes. This only works against certificate-based revocations (hash-based dbx entries are unaffected) and requires the second-stage loader to be signed by a certificate embedded in the shim's own trust chain.
CVE-2026-8863 covers the composite exploit chain: an attacker places one of the 11 legacimate, Microsoft-signed-but-vulnerable shim binaries plus an old, unpatched GRUB 2 build (itself carrying the decade-old CVE-2015-5281, which allows unsigned multiboot/multiboot2 kernel modules to be loaded without a signature check) onto a system's EFI System Partition. Firmware trusts and loads the old shim (it is still signed by a certificate in the system's `db`); the shim in turn validates GRUB 2 using its embedded vendor certificate; the revocation-check confusion above lets a revoked/malicious GRUB 2 pass; GRUB 2's multiboot2 loader then loads unsigned code with no further verification. The net effect is arbitrary code execution during the boot process on essentially any UEFI-based machine that trusts the Microsoft third-party CA, independent of which operating system (if any) is actually installed — this is functionally a 'Bring Your Own Vulnerable Driver' (BYOVD)-style attack applied to the boot chain rather than to a kernel driver.
Because execution happens before the OS kernel and any endpoint security agent initializes, a successful exploit can install a UEFI bootkit that persists across OS reinstalls and evades EDR/AV entirely — the same class of impact demonstrated by real-world bootkits Bootkitty (first UEFI bootkit targeting Linux), HybridPetya, and BlackLotus, all of which ESET cites as precedent. ESET deliberately withheld indicators of compromise, noting the vulnerable shims are embedded inside legitimate, widely distributed software packages (PC diagnostic tools, disk-wipe utilities, exam kiosk software, Linux installers) across an unknown number of systems, and publishing IOCs risked mass false-positive identification of benign, unexploited installations.
CERT/CC's VU#616257 enumerates confirmed-affected vendors: Spyrus WTGCreator (shim ≤0.7), Red Hat Enterprise Linux 7.2 and CentOS 7.2 (shim 0.9), Baramundi Management Suite up to 2024R1 (shim 0.8), WhiteCanyon/Blancco WipeDrive 8.0.0-8.1.3 (shim 0.7), Finland's Matriculation Examination Board's Abitti 1.0 exam software (shim 0.8), NTC IT ROSA Linux R9/R10 (shim 0.9), Oracle Linux 7.2 (shim 0.9), PC-Doctor Service Center 15/16 (shim 0.9), and openSUSE's UEFI shim loader 0.9/2.1. Intel and AMI confirmed their products do not contain the vulnerable shims; over 30 other vendors, including Dell, HP, Microsoft, and Lenovo, have an unknown/unconfirmed status as of publication. Disclosure was coordinated: an initial May 19, 2026 public-disclosure date was postponed to June 9, 2026 to align with Microsoft's Patch Tuesday dbx rollout. ESET published its full research write-up on July 14, 2026, noting that the Microsoft Corporation UEFI CA 2011 certificate's own June 27, 2026 expiration has no bearing on Secure Boot enforcement absent explicit hash-based dbx revocation of each individual vulnerable binary.
MITRE ATT&CK techniques used in TL-2026-1340
Defense Evasion
T1014 Rootkit; T1211 Exploitation for Stealth; T1542.001 System Firmware
Discovery
T1082 System Information Discovery
Initial Access
T1195 Supply Chain Compromise; T1195.002 Compromise Software Supply Chain
Impact
stealth
Persistence
T1542.001 System Firmware; T1542.003 Bootkit
Privilege Escalation
T1547 Boot or Logon Autostart Execution
defense-impairment
T1553.002 Code Signing; T1553.006 Code Signing Policy Modification; T1601.001 Patch System Image; T1685 Disable or Modify Tools
Resource Development
T1588.003 Code Signing Certificates
Reconnaissance
Affected products and versions in 11-Year-Old Linux UEFI Shim Bootloader Flaws Enable Secure
- Spyrus — WTGCreator
Vulnerable versions: shim 0.7 and earlier
Fixed in: dbx revocation applied June 9, 2026 - Red Hat — Enterprise Linux
Vulnerable versions: 7.2 (shim 0.9)
Fixed in: dbx revocation applied June 9, 2026 - Red Hat — CentOS
Vulnerable versions: 7.2 (shim 0.9)
Fixed in: dbx revocation applied June 9, 2026 - Baramundi — Management Suite
Vulnerable versions: up to 2024R1 (shim 0.8)
Fixed in: dbx revocation applied June 9, 2026 - WhiteCanyon/Blancco — WipeDrive
Vulnerable versions: 8.0.0-8.1.3 (shim 0.7)
Fixed in: dbx revocation applied June 9, 2026 - Finland's Matriculation Examination Board — Abitti
Vulnerable versions: 1.0 (shim 0.8)
Fixed in: dbx revocation applied June 9, 2026 - NTC IT ROSA — ROSA Linux
Vulnerable versions: R9, R10 (shim 0.9)
Fixed in: dbx revocation applied June 9, 2026 - Oracle — Oracle Linux
Vulnerable versions: 7.2 (shim 0.9)
Fixed in: dbx revocation applied June 9, 2026 - PC-Doctor — Service Center
Vulnerable versions: 15, 16 (shim 0.9)
Fixed in: dbx revocation applied June 9, 2026 - openSUSE — UEFI shim / shim
Vulnerable versions: 0.9, shim 2.1
Fixed in: dbx revocation applied June 9, 2026
Remediation for 11-Year-Old Linux UEFI Shim Bootloader Flaws Enable Secure
Patches
- Microsoft dbx revocation update, June 9, 2026 Patch Tuesday (revokes all 11 vulnerable shim binary hashes)
Immediate actions
- Apply the Microsoft June 9, 2026 Patch Tuesday dbx (UEFI Forbidden Signature Database) revocation update, which blocklists all 11 identified vulnerable shim hashes
- Update the authorized signature database (db) before applying dbx revocations, in that order, to avoid rendering systems unbootable
- Thoroughly test the dbx update on representative hardware/firmware before broad fleet deployment
- On Windows, verify revocation status with the Check-UEFISecureBootVariables PowerShell tooling
- On Linux, verify revocation status with the uefi-dbx-audit script and update firmware/shim packages via the Linux Vendor Firmware Service (fwupd)
Workarounds
- Where dbx update cannot yet be deployed, restrict physical/administrative access to systems since exploitation requires the ability to write to the EFI System Partition or otherwise modify the boot chain
- Disable third-party UEFI CA trust in firmware settings on hardware that does not require booting non-OEM-signed Linux/utility media
Longer-term hardening
- Inventory all UEFI shim and second-stage bootloader binaries in use across the fleet, including those bundled inside PC-diagnostic tools, disk-wipe utilities, and exam/kiosk software, not just the primary OS installer
- Require vendors who fork shim to rebase onto current upstream releases rather than freezing on old, vulnerable forks
- On Windows 11 Secured-core PCs, disable trust in the third-party Microsoft Corporation UEFI CA 2011 certificate where compatibility with third-party Linux/utility boot media is not required
- Monitor Microsoft's microsoft/secureboot_objects GitHub repository for future dbx update files and adopt them promptly
- Deploy boot-integrity/attestation monitoring (e.g., TPM-based measured boot logging) to detect anomalous EFI System Partition content
CVEs associated with 11-Year-Old Linux UEFI Shim Bootloader Flaws Enable Secure
CVE-2026-8863, CVE-2026-10797, CVE-2015-5281
Weaknesses (CWE) in 11-Year-Old Linux UEFI Shim Bootloader Flaws Enable Secure
CWE-347, CWE-354, CWE-706
Timeline of 11-Year-Old Linux UEFI Shim Bootloader Flaws Enable Secure
- ESET researcher Martin Smolar reports 11 vulnerable, Microsoft-signed UEFI shim bootloaders to CERT/CC with proof-of-concept detail; CERT/CC opens its vendor notification period (2026-02-16 to 2026-05-18)
- Initial coordinated public-disclosure date set for May 19, 2026
- Public disclosure date postponed to June 9, 2026 to align with Microsoft's Patch Tuesday cycle
- CERT/CC's multi-vendor notification period for VU#616257 closes ahead of the (subsequently postponed) coordinated public disclosure
- Microsoft ships a dbx (UEFI Forbidden Signature Database) revocation update as part of June 2026 Patch Tuesday, revoking all 11 identified vulnerable shim hashes; CVE-2026-8863 and CVE-2026-10797 formally assigned/published
- The 'Microsoft Corporation UEFI CA 2011' signing certificate used on the vulnerable shims reaches its own expiration date (noted by ESET as irrelevant to Secure Boot enforcement absent explicit dbx revocation)
- CERT/CC VU#616257 reaches Document Revision 8 (its last-revised state as of publication), coinciding with ESET's public research release and same-day coverage by The Hacker News, Help Net Security, and CyberInsider
- CERT/CC VU#616257 confirms 10 vendors affected (Spyrus, Red Hat, Baramundi, WhiteCanyon/Blancco, Finland's Matriculation Examination Board, NTC IT ROSA, Oracle, PC-Doctor, openSUSE), confirms Intel unaffected, and lists 30+ vendors including Dell, HP, Microsoft, and Lenovo as status-unknown
- ESET publishes full technical research 'Forgotten UEFI shims undermining Secure Boot' on WeLiveSecurity; CERT/CC publishes VU#616257; coverage by The Hacker News, Cyber Security News, Help Net Security, and CyberInsider follows same-day
Sources cited for 11-Year-Old Linux UEFI Shim Bootloader Flaws Enable Secure
- Forgotten UEFI shims undermining Secure Boot
- VU#616257 - Microsoft-signed UEFI shim bootloaders vulnerable to Secure Boot bypass
- 11 Old Microsoft-Signed Linux UEFI Shims Could Let Attackers Bypass Secure Boot
- 11-Year-Old Linux UEFI Shim Bootloaders Let Attackers Bypass Secure Boot
- No one knows how many old shims can still bypass UEFI Secure Boot
- Microsoft-signed UEFI bootloaders vulnerable to Secure Boot bypass
- CVE-2026-8863 Secure Boot Bypass: What It Means for Windows Boot Trust
- CVE-2026-8863 Record
- CVE-2026-10797 Record
- microsoft/secureboot_objects (DBX update files)
Threats related to 11-Year-Old Linux UEFI Shim Bootloader Flaws Enable Secure
- Forgotten UEFI Shims Undermine Secure Boot (CVE-2026-8863, CVE-2026-10797)
- "Download More RAM" Attack Bypasses Windows VBS and Disables Defender Through Memory Aliasing (CVE-2026-23670)
- usbliter8 — Unpatchable BootROM USB DMA Exploit on Apple A12/A12X/A12Z/A13 and S4/S5 Chips Bypassing Secure Boot
- Dell BIOS Flaw (CVE-2026-40639 / DSA-2026-197) Lets Attackers Recover Admin Passwords From SPI Flash
Detection coverage for TL-2026-1340
As of 2026-07-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1340 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.