Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2026-00477

Опубликовано: 13 янв. 2026
Источник: fstec
CVSS3: 6.4
CVSS2: 6
EPSS Низкий

Описание

Уязвимость реализации протокола безопасной загрузки Secure Boot операционных систем Windows связана с истечение срока действия сертификатов KEK, UEFI и PCA. Эксплуатация уязвимости может позволить нарушителю обойти существующие ограничения безопасности

Вендор

Microsoft Corp

Наименование ПО

Windows Server 2025
Windows 11 24H2
Windows Server 2022, 23H2 Edition (Server Core installation)
Windows 11 23H2
Windows 11 25H2
Windows Server 2025 (Server Core installation)
Windows 10 22H2
Windows 10 21H2
Windows Server 2022 (Server Core installation)
Windows Server 2022
Windows Server 2019 (Server Core installation)
Windows Server 2019
Windows 10 1809
Windows Server 2012 R2 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 (Server Core installation)
Windows Server 2012
Windows Server 2016 (Server Core installation)
Windows Server 2016
Windows 10 1607

Версия ПО

до 10.0.26100.32230 (Windows Server 2025)
до 10.0.26100.7623 (Windows 11 24H2)
до 10.0.26100.7623 (Windows 11 24H2)
до 10.0.25398.2092 (Windows Server 2022, 23H2 Edition (Server Core installation))
до 10.0.22631.6491 (Windows 11 23H2)
до 10.0.22631.6491 (Windows 11 23H2)
до 10.0.26200.7623 (Windows 11 25H2)
до 10.0.26200.7623 (Windows 11 25H2)
до 10.0.26100.32230 (Windows Server 2025 (Server Core installation))
до 10.0.19045.6809 (Windows 10 22H2)
до 10.0.19045.6809 (Windows 10 22H2)
до 10.0.19045.6809 (Windows 10 22H2)
до 10.0.19044.6809 (Windows 10 21H2)
до 10.0.19044.6809 (Windows 10 21H2)
до 10.0.19044.6809 (Windows 10 21H2)
до 10.0.20348.4648 (Windows Server 2022 (Server Core installation))
до 10.0.20348.4648 (Windows Server 2022)
до 10.0.17763.8276 (Windows Server 2019 (Server Core installation))
до 10.0.17763.8276 (Windows Server 2019)
до 10.0.17763.8276 (Windows 10 1809)
до 10.0.17763.8276 (Windows 10 1809)
до 6.3.9600.22968 (Windows Server 2012 R2 (Server Core installation))
до 6.3.9600.22968 (Windows Server 2012 R2)
до 6.2.9200.25868 (Windows Server 2012 (Server Core installation))
до 6.2.9200.25868 (Windows Server 2012)
до 10.0.14393.8783 (Windows Server 2016 (Server Core installation))
до 10.0.14393.8783 (Windows Server 2016)
до 10.0.14393.8783 (Windows 10 1607)
до 10.0.14393.8783 (Windows 10 1607)

Тип ПО

Операционная система

Операционные системы и аппаратные платформы

Microsoft Corp Windows Server 2025 до 10.0.26100.32230
Microsoft Corp Windows 11 24H2 до 10.0.26100.7623
Microsoft Corp Windows 11 24H2 до 10.0.26100.7623
Microsoft Corp Windows Server 2022, 23H2 Edition (Server Core installation) до 10.0.25398.2092
Microsoft Corp Windows 11 23H2 до 10.0.22631.6491
Microsoft Corp Windows 11 23H2 до 10.0.22631.6491
Microsoft Corp Windows 11 25H2 до 10.0.26200.7623
Microsoft Corp Windows 11 25H2 до 10.0.26200.7623
Microsoft Corp Windows Server 2025 (Server Core installation) до 10.0.26100.32230
Microsoft Corp Windows 10 22H2 до 10.0.19045.6809
Microsoft Corp Windows 10 22H2 до 10.0.19045.6809
Microsoft Corp Windows 10 22H2 до 10.0.19045.6809
Microsoft Corp Windows 10 21H2 до 10.0.19044.6809
Microsoft Corp Windows 10 21H2 до 10.0.19044.6809
Microsoft Corp Windows 10 21H2 до 10.0.19044.6809
Microsoft Corp Windows Server 2022 (Server Core installation) до 10.0.20348.4648
Microsoft Corp Windows Server 2022 до 10.0.20348.4648
Microsoft Corp Windows Server 2019 (Server Core installation) до 10.0.17763.8276
Microsoft Corp Windows Server 2019 до 10.0.17763.8276
Microsoft Corp Windows 10 1809 до 10.0.17763.8276
Microsoft Corp Windows 10 1809 до 10.0.17763.8276
Microsoft Corp Windows Server 2012 R2 (Server Core installation) до 6.3.9600.22968
Microsoft Corp Windows Server 2012 R2 до 6.3.9600.22968
Microsoft Corp Windows Server 2012 (Server Core installation) до 6.2.9200.25868
Microsoft Corp Windows Server 2012 до 6.2.9200.25868
Microsoft Corp Windows Server 2016 (Server Core installation) до 10.0.14393.8783
Microsoft Corp Windows Server 2016 до 10.0.14393.8783
Microsoft Corp Windows 10 1607 до 10.0.14393.8783
Microsoft Corp Windows 10 1607 до 10.0.14393.8783

Уровень опасности уязвимости

Средний уровень опасности (базовая оценка CVSS 2.0 составляет 6)
Средний уровень опасности (базовая оценка CVSS 3.1 составляет 6,4)

Возможные меры по устранению уязвимости

Использование рекомендаций производителя:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21265

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Существует

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 46%
0.00236
Низкий

6.4 Medium

CVSS3

6 Medium

CVSS2

Связанные уязвимости

CVSS3: 6.4
ubuntu
21 день назад

Windows Secure Boot stores Microsoft certificates in the UEFI KEK and DB. These original certificates are approaching expiration, and devices containing affected certificate versions must update them to maintain Secure Boot functionality and avoid compromising security by losing security fixes related to Windows boot manager or Secure Boot. The operating system’s certificate update protection mechanism relies on firmware components that might contain defects, which can cause certificate trust updates to fail or behave unpredictably. This leads to potential disruption of the Secure Boot trust chain and requires careful validation and deployment to restore intended security guarantees. Certificate Authority (CA) Location Purpose Expiration Date Microsoft Corporation KEK CA 2011 KEK Signs updates to the DB and DBX 06/24/2026 Microsoft Corporation UEFI CA 2011 DB Signs 3rd party boot loaders, Option ROMs, etc. 06/27/2026 Microsoft Windows Production PCA 2011 DB Signs the Windows Boot ...

CVSS3: 6.4
nvd
21 день назад

Windows Secure Boot stores Microsoft certificates in the UEFI KEK and DB. These original certificates are approaching expiration, and devices containing affected certificate versions must update them to maintain Secure Boot functionality and avoid compromising security by losing security fixes related to Windows boot manager or Secure Boot. The operating system’s certificate update protection mechanism relies on firmware components that might contain defects, which can cause certificate trust updates to fail or behave unpredictably. This leads to potential disruption of the Secure Boot trust chain and requires careful validation and deployment to restore intended security guarantees. Certificate Authority (CA) Location Purpose Expiration Date Microsoft Corporation KEK CA 2011 KEK Signs updates to the DB and DBX 06/24/2026 Microsoft Corporation UEFI CA 2011 DB Signs 3rd party boot loaders, Option ROMs, etc. 06/27/2026 Microsoft Windows Production PCA 2011 DB Signs the Windo

CVSS3: 6.4
msrc
22 дня назад

Secure Boot Certificate Expiration Security Feature Bypass Vulnerability

CVSS3: 6.4
github
21 день назад

Windows Secure Boot stores Microsoft certificates in the UEFI KEK and DB. These original certificates are approaching expiration, and devices containing affected certificate versions must update them to maintain Secure Boot functionality and avoid compromising security by losing security fixes related to Windows boot manager or Secure Boot. The operating system’s certificate update protection mechanism relies on firmware components that might contain defects, which can cause certificate trust updates to fail or behave unpredictably. This leads to potential disruption of the Secure Boot trust chain and requires careful validation and deployment to restore intended security guarantees. Certificate Authority (CA) Location Purpose Expiration Date Microsoft Corporation KEK CA 2011 KEK Signs updates to the DB and DBX 06/24/2026 Microsoft Corporation UEFI CA 2011 DB Signs 3rd party boot loaders, Option ROMs, etc. 06/27/2026 Microsoft Windows Production PCA 2011 DB Signs the Wi...

EPSS

Процентиль: 46%
0.00236
Низкий

6.4 Medium

CVSS3

6 Medium

CVSS2