# Vendor shim bootloaders enable Secure Boot bypass

Published: 2026-06-09 · Severity: medium · Sectors: technology
Canonical: https://vorant.io/reports/ca554c01-9912-54ce-924a-7d324392b795/vendor-shim-bootloaders-enable-secure-boot-bypass

> Outdated vendor forks of the open-source shim UEFI bootloader can be exploited to bypass Secure Boot and execute code before the OS loads.

ESET researcher Martin Smolar identified multiple vendor-forked versions of the open-source shim UEFI bootloader (primarily version 0.9 and earlier) that were never updated after upstream security fixes were released. Because these outdated shim bootloaders remain signed by Microsoft's UEFI CA 2011 certificate and have not been added to the Forbidden Signature Database (DBX), they continue to be trusted by Secure Boot-enabled systems even when otherwise fully patched, creating a long-standing supply-chain exposure across the UEFI ecosystem.

An attacker with administrative access or the ability to tamper with the boot chain could leverage one of these vulnerable shim binaries in a BYOVD-style attack to execute arbitrary code during early boot, before the operating system and most security tooling (including EDR) initialize. This can lead to persistent, stealthy compromise that survives reboots and even OS reinstallation, since the malicious code operates below the visibility of OS-level defenses.

Microsoft will add the affected bootloaders to the DBX revocation list as part of coordinated disclosure. Organizations should apply vendor firmware/bootloader updates and subsequent DBX updates (in the correct DB-then-DBX order to avoid bricking systems), and use audit tools such as Check-UEFISecureBootVariables or uefi-dbx-audit to verify exposure across fleets, particularly in large-scale enterprise, cloud, and virtualization environments.

## Mentioned in this report

- Vulnerabilities: CVE-2026-8863

## Detection guidance (public sample)

### Suspicious EFI Bootloader File Write to EFI System Partition

ATT&CK: T1542.003

Detects creation or modification of .efi bootloader files (e.g. shim, grub) within EFI System Partition paths outside of expected OS update processes, consistent with planting a vulnerable/outdated shim for a Secure Boot bypass bootkit. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious EFI Bootloader File Write to EFI System Partition
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
    - \EFI\Boot\
    - \EFI\Microsoft\Boot\
    - \EFI\ubuntu\
    - \EFI\redhat\
    - \EFI\centos\
    - \EFI\fedora\
    - \EFI\opensuse\
    TargetFilename|endswith:
    - .efi
  filter:
    Image|endswith:
    - \TiWorker.exe
    - \TrustedInstaller.exe
    - \dism.exe
    - \poqexec.exe
    - \bootim.exe
  condition: selection and not filter
falsepositives:
- Legitimate Windows Update or OS servicing operations updating boot components
- OS installation, imaging, or dual-boot bootloader (GRUB) maintenance by administrators
- Firmware/bootloader vendor patch deployment tools
level: high
tags:
- attack.t1542.003
- attack.persistence
id: 0fe86d8c-52a8-5398-b64f-d72befd2e908
status: experimental
author: Vorant
```

### Boot Configuration Data Modification via bcdedit Referencing Custom Loader Path

ATT&CK: T1542.003

Detects use of bcdedit.exe to create or modify boot entries pointing to non-default bootloader paths, which can be used to chain-load a vulnerable/outdated signed shim binary as part of a Secure Boot bypass bootkit. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Boot Configuration Data Modification via bcdedit Referencing Custom Loader
  Path
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \bcdedit.exe
    CommandLine|contains:
    - /set
    - /create
    - /copy
  suspicious_path:
    CommandLine|contains:
    - path
    - .efi
  filter:
    CommandLine|contains:
    - \Windows\System32\winload.efi
    - \Windows\System32\Boot\winload.efi
    - \bootmgfw.efi
  condition: selection and suspicious_path and not filter
falsepositives:
- Legitimate dual-boot configuration or recovery environment setup by administrators
- OEM/vendor bootloader repair or firmware update tooling
level: medium
tags:
- attack.t1542.003
- attack.defense-evasion
id: 4775ce79-33ae-5dee-9f36-a46e28460a31
status: experimental
author: Vorant
```

### EFI System Partition Manually Mounted via mountvol or diskpart

ATT&CK: T1542.003

Detects manual mounting of the hidden EFI System Partition using mountvol or diskpart, a common precursor step to reading, replacing, or planting bootloader files (e.g. an outdated vulnerable shim) for a bootkit-based Secure Boot bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: EFI System Partition Manually Mounted via mountvol or diskpart
logsource:
  category: process_creation
  product: windows
detection:
  selection_mountvol:
    Image|endswith: \mountvol.exe
    CommandLine|contains: ':'
  selection_diskpart:
    Image|endswith: \diskpart.exe
  esp_indicator:
    CommandLine|contains:
    - EFI
    - System Partition
    - ESP
  condition: (selection_mountvol or selection_diskpart) and esp_indicator
falsepositives:
- Administrators performing legitimate boot repair, dual-boot setup, or firmware update
  tasks
- Imaging and deployment tools (e.g. MDT, SCCM) accessing the EFI partition during
  OS provisioning
level: medium
tags:
- attack.t1542.003
- attack.defense-evasion
id: ebd2f2e4-5cc3-5062-ac6a-ae3463bebc49
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://kb.cert.org/vuls/id/616257

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/ca554c01-9912-54ce-924a-7d324392b795/vendor-shim-bootloaders-enable-secure-boot-bypass.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup