11 Old Microsoft-Signed UEFI Shims Enable Secure Boot Bypass

Wed, 15 Jul 2026 12:11:39 +0000

Engineer — Plan: No active exploitation or PoC yet, but these are legitimately signed shims that could be weaponized for UEFI bootkit deployment — audit your systems’ Secure Boot allowlists and verify no deprecated shim binaries are present in your boot chain.
SOC/IR — Learn: UEFI bootkit delivery via trusted-but-vulnerable signed shims is a useful persistence vector to understand; no exploitation is occurring now and no IOCs or detection guidance are available yet, but worth filing against future UEFI anomaly detection work.
Leader — Skip

Secure-Boot on CuraSec