11 Old Microsoft-Signed Linux UEFI Shims Could Let Attackers Bypass Secure Boot
Researchers have discovered 11 outdated, Microsoft-signed UEFI shim bootloaders that could be exploited to bypass Secure Boot on systems relying on these shims. These bootloaders, primarily from versions 0.7 and earlier, were signed with a certificate that has expired but remained trusted due to a lack of revocation. Attackers could replace these shims with older, vulnerable versions to execute arbitrary code before the operating system loads, effectively bypassing Secure Boot and other security measures. The issue stems from a failure to update these bootloaders, despite the availability of patches and a revocation list.
Researchers have discovered 11 outdated, Microsoft-signed UEFI shim bootloaders that could be exploited to bypass Secure Boot on systems relying on these shims. These bootloaders, primarily from versions 0.7 and earlier, were signed with a certificate that has expired but remained trusted due to a lack of revocation. Attackers could replace these shims with older, vulnerable versions to execute arbitrary code before the operating system loads, effectively bypassing Secure Boot and other security measures. The issue stems from a failure to update these bootloaders, despite the availability of patches and a revocation list.
These shims are lightweight UEFI bootloaders designed to allow Linux distributions to boot when Secure Boot is enabled. They act as an intermediary between the motherboard firmware and the Linux operating system. The vulnerability lies in the fact that these bootloaders were signed with the Microsoft "Microsoft Corporation UEFI CA 2011" certificate, which expired on June 27, 2026, but were not explicitly revoked through the Microsoft-signed DBX revocation list. This meant that Secure Boot systems continued to trust these older, vulnerable shims.
An attacker could replace these shims with older, vulnerable versions, bypassing Secure Boot and allowing them to execute arbitrary code before the operating system loads. This circumvents detection by built-in security controls and endpoint detection and response (EDR) solutions, as malicious code is executed before the OS and security products are initialized. The issue is exacerbated by the Machine Owner Key (MOK) allowlist, which, while designed to authorize unsigned drivers, could be exploited by replacing the up-to-date shim with an older, still-trusted, but unrevoked shim binary, effectively bypassing MOK denylist enforcement.
The vulnerabilities are tracked under the CVE identifiers CVE-2026-8863 and CVE-2026-10797. ESET has warned that the expiration of the "Microsoft Corporation UEFI CA 2011" certificate has no bearing on the Secure Boot verification process as long as the bootloaders signed with the expired certificate are not explicitly revoked by hash. The Slovak cybersecurity company emphasized that no novel vulnerability is needed to bypass UEFI Secure Boot – only a copy of an old, still-trusted, but unrevoked shim binary and a basic understanding of how UEFI shims work.
Affected products include: Spyrus WTGCreator, RedHat RedHat Enterprise Linux, RedHat CentOS, Baramundi software baramundi Management Suite, WhiteCanyon/Blancco WipeDrive, Finland's Matriculation Examination Board Abitti 1, NTC IT ROSA, LLC ROSA Linux, Oracle America, Inc. OracleLinux, PC-Doctor, Inc. PC Doctor Service Center, OpenSuse OpenSuse UEFI Shim loader, and OpenSuse OpenSuse Shim. The CERT Coordination Center (CERT/CC) noted that vendor-specific bootloaders have not been updated to address vulnerabilities in the upstream project after they became publicly known and fixed.