ESET researchers disclosed on July 14, 2026 that 11 old, forgotten UEFI shim bootloaders, all signed by Microsoft’s own certificate authority, can still be used to bypass Secure Boot on any UEFI system that trusts them, a decade-plus after the flaws they carry were first documented elsewhere.
The shims, versions 0.9 and earlier, sit between a computer’s firmware and Linux, and each was signed under the “Microsoft Corporation UEFI CA 2011” certificate that most PCs trust by default. ESET researcher Martin Smolar found that because these old shims never enforced the MOK revocation denylist or SBAT (Secure Boot Advanced Targeting) revocation policies introduced later, an attacker with administrative access or the ability to modify the boot process can load one of them and use it to run unsigned code before the operating system, and before most endpoint security tools, ever start. ESET reported the findings to CERT/CC in February 2026, and Microsoft revoked the 11 shims in its June 9 Patch Tuesday update, assigning the flaws CVE-2026-8863 and CVE-2026-10797.
For security leaders, the finding matters less as a novel exploit than as a supply chain accounting problem. The same class of firmware-level persistence has already been used by real bootkits, including BlackLotus, Bootkitty, and HybridPetya, and a bootkit planted this way survives a full operating system reinstall, since it lives in firmware rather than on disk. CyberTech recently covered a similar firmware trust gap in U-Boot, and the pattern is the same: boot-time trust chains accumulate old, signed components nobody tracks until a researcher goes looking. ESET’s own conclusion, that better shim-signing transparency and SBAT tracking make revocation “far more efficient than in the past,” is really an admission that most organizations have no inventory of which signed boot components their fleets still trust. Security teams should apply the June and July Microsoft dbx updates without delay, confirm Linux systems have pulled current revocations through the Linux Vendor Firmware Service, and treat firmware and bootloader inventory as its own asset category.
Source: ESET
