CVE-2026-8863

State: Published
Severity: 7.8 High
Published: Jun 9, 2026
Updated: Jun 10, 2026
Reserved: May 18, 2026

Description

Multiple Microsoft-sigend UEFI SHIM bootloaders are vulnerable to SecureBoot bypass. An attacker with administrative privileges or the ability to modify the boot process could use one of the vulnerable shim bootloaders to bypass Secure Boot protections and execute arbitrary code before the operating system loads. Specific UEFI DBX update is required to block these vulnerable boot loaders.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
OracleLinux(7.2) shimOracle Corporation	0.9Affected
Service Center EnterprisePC-Doctor	14 through 17.0.7536.900Affected
Service Center Drive ErasePC-Doctor	15 through 17.0.7538.592Affected
Service Center JapanPC-Doctor	15 through 17.0.7539.904Affected
Service CenterPC-Doctor	14 through 17.0.7535.900Affected
Network Factory for Linux (Bootable Diagnostics)PC-Doctor	6.9 through 6.20.7711.267Affected
Factory for Linux (Bootable Diagnostics)PC-Doctor	6.9 through 6.20.7710.267Affected
WTGCreatorSpyrus	4.2Affected
WhiteCanyon WipeDriveBlancco UK	8.0.0 through 8.1.3Affected
baramundi Management Suitebaramundi software	2024R1 and earlierAffected
OpenSUSE shimSUSE Linux	0.9Affected
Abitti 1Finland Matriculation Board	1.0.0Affected
RosaLinuxNTC IT ROSA LLC	R9Affected
RosaLinuxNTC IT ROSA LLC	R10Affected

References

Microsoft Vendor Security Advisoryvendor-advisory
CERT/CC Vulnerability Noticethird-party-advisory
https://www.kb.cert.org/vuls/id/616257

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.