CVE-2026-45654: Secure Boot Security Feature Bypass Vulnerability

Synopsis

A protection mechanism failure in Windows Secure Boot allows a locally present, privileged attacker to bypass the Secure Boot security feature. The vulnerability requires an existing admin-level account on the host and is exploited entirely at the local level with no network access needed. Successful exploitation lets the attacker load unsigned or untrusted boot components, undermining boot-integrity guarantees and enabling persistent, low-level tampering that survives reboots. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running affected Windows 11 or Windows Server 2025 builds.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the target is required.

• AuthenticationRequired

  An admin or otherwise privileged account on the local machine is required; standard user access is not sufficient.

• Victim interactionNot required

  No action from another user or operator is needed to trigger the vulnerability.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, memory-layout dependencies, or other environmental factors need to be satisfied.

Blast Radius

• Attacker loads unsigned or tampered bootloaders, bypassing Secure Boot enforcement on the affected host.
• Boot-level persistence becomes possible: malicious components injected before the OS loads survive reboots and standard OS-level defenses.
• Integrity guarantees provided by measured boot and attestation flows are broken, making remote attestation results untrustworthy.
• Confidentiality and availability of the running OS are not directly impacted by this specific flaw, but the bypass enables follow-on attacks that can affect both.