CVE-2026-8863: CVE-2026-8863

Synopsis

A Secure Boot bypass vulnerability affects multiple UEFI SHIM bootloaders that carry valid Microsoft signatures, including products from Oracle, PC-Doctor, and Spyrus. The vulnerability is reached locally and requires low-privilege access (or administrative access to the boot process), with no user interaction needed. Successful exploitation lets an attacker execute arbitrary code before the operating system loads, completely bypassing Secure Boot integrity protections. No fix versions have been published; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing exposure is required.

• AuthenticationRequired

  A low-privilege local account is sufficient, though the description also notes that administrative or boot-process access achieves the same result.

• Victim interactionNot required

  No victim action is required; the attacker can carry out the exploit without any user involvement.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Executes arbitrary code in the pre-OS boot environment, before any operating system security controls or kernel protections are loaded.
• Bypasses UEFI Secure Boot integrity checks entirely, allowing unsigned or malicious bootloaders and kernels to run as trusted.
• Persists implants or rootkits at the firmware/bootloader layer, where standard OS-level detection and remediation tools cannot reach.
• Compromises confidentiality, integrity, and availability of the entire system, including all data and services running on top of the affected host.