CVE-2026-48575: Windows Secure Boot Protection Mechanism Failure – HIGH Severity

Technical summary

CVE-2026-48575 is a protection mechanism failure (CWE-693) in the Windows Secure Boot implementation. The vulnerability allows an authenticated local attacker with high privileges to circumvent Secure Boot's integrity verification mechanisms, enabling the execution of untrusted firmware or bootloader code. The CVSS 3.1 score of 7.9 (HIGH) reflects the local attack vector, high privilege requirement, but significant scope and confidentiality/integrity impact. The attack requires no user interaction and can affect system confidentiality and integrity across the entire system boundary.

Business impact

Successful exploitation enables attackers with administrative access to establish persistent, low-level code execution that can survive operating system reinstallation and remain undetected by conventional endpoint security tools. This represents a stepping stone toward advanced persistence, firmware rootkits, or supply-chain attacks. Organizations operating secure-boot-dependent environments—such as those in healthcare, finance, or critical infrastructure—face elevated risk of sophisticated compromise and forensic evasion.

Affected systems

The vulnerability impacts a broad range of Windows platforms: Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server editions 2012, 2016, 2019, 2022, and 2025. Given the breadth of affected versions spanning multiple OS families and extended support timelines, patch deployment will require significant coordination across diverse environments.

Exploitability

Exploitation requires local system access and administrative privileges, significantly limiting the attacker pool to insiders, malware with escalated rights, or adversaries who have already compromised local authentication. The attack vector and privilege requirement place this in the 'difficult but not impossible' category for motivated threat actors. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting no active exploitation in the wild at publication, though the firmware-level nature of the flaw makes it attractive for advanced persistent threat (APT) operations.

Remediation

Microsoft has issued security updates addressing this vulnerability. Organizations should consult Microsoft's official security bulletin for the specific patch versions applicable to their Windows 10, Windows 11, and Windows Server editions. Patches should be prioritized based on asset criticality and exposure. Given the administrative privilege requirement, compensating controls such as firmware attestation, privileged access management (PAM), and behavioral monitoring for suspicious firmware manipulation can reduce risk while patches are staged.

Patch guidance

Apply the latest security updates from Microsoft for your specific Windows edition and version. Windows 10 users should update to the latest cumulative update for their respective version (1607, 1809, 21H2, or 22H2). Windows 11 users should update to the latest available patch for their version (23H2, 24H2, 25H2, or 26H1). Windows Server administrators should apply the June 2026 security updates and later for Server 2012, 2016, 2019, 2022, and 2025. Verify patch status through Windows Update or WSUS, and test patches in non-production environments before broad deployment given the firmware-level nature of the fix.

Detection guidance

Monitor for suspicious Secure Boot configuration changes, failed Secure Boot validation events in the Windows Event Log (System channel, Event ID 64), and unauthorized UEFI/firmware access attempts. Endpoint Detection and Response (EDR) tools should flag attempts to disable Secure Boot or modify firmware settings by non-authorized processes. Firmware attestation solutions that verify boot integrity against known-good baselines can detect post-exploitation persistence. Organizations should also audit administrative command execution and use of firmware management utilities on sensitive systems.

Why prioritize this

While the privilege requirement limits immediate exploitability, the firmware-level impact and breadth of affected products warrant expedited remediation. This vulnerability represents a high-value target for nation-state and financially motivated APTs seeking durable persistence mechanisms. Organizations should prioritize patching internet-facing servers, Domain Controllers, and systems handling sensitive data ahead of general client deployments. The presence of the vulnerability across Windows 10 extended support, Windows 11, and legacy Windows Server versions complicates patching logistics and extends the attack window if updates are delayed.

Risk score, explained

The CVSS 3.1 HIGH score (7.9) reflects the significant confidentiality and integrity impact balanced against the mandatory local, high-privilege attack precondition. The scope is changed, meaning the vulnerability can affect system components beyond the security feature itself (firmware execution context). However, the lack of availability impact and the steep privilege barrier prevent a CRITICAL rating. Organizations should treat this as higher priority than the numeric score alone suggests, given the firmware-level nature and difficulty of detecting exploitation post-compromise.

Frequently asked questions