CVE-2026-45588: Secure Boot Security Feature Bypass Vulnerability

Synopsis

A protection mechanism failure in Windows Secure Boot allows a local attacker with administrative privileges to bypass the Secure Boot security feature entirely. The vulnerability is exploited locally, meaning the attacker must already have a shell or elevated process on the affected host, and no network access or victim interaction is needed. Successful exploitation lets an attacker load unsigned or tampered boot components, undermining the integrity guarantees that Secure Boot is designed to provide. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running affected Windows versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the target is required.

• AuthenticationRequired

  An administrative or otherwise privileged account is required to trigger the vulnerability.

• Victim interactionNot required

  No victim action is needed; the attacker operates entirely on their own without requiring a user to click or open anything.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layout, or other variable environmental factors.

Blast Radius

• A successful attacker disables the Secure Boot integrity check, allowing unsigned or maliciously modified boot-stage binaries to load on the system.
• With Secure Boot bypassed, an attacker can persist a bootkit or tampered bootloader that survives OS reinstalls and is invisible to standard endpoint detection running after boot.
• Confidential data protected by policies that assume a trusted boot chain (such as BitLocker keys sealed to a TPM with Secure Boot assertions) may be exposed.