CVE-2026-21265: Secure Boot Certificate Expiration Security Feature Bypass Vulnerability
Secure Boot Certificate Expiration Security Feature Bypass Vulnerability
Other sources
Windows Secure Boot stores Microsoft certificates in the UEFI KEK and DB. These original certificates are approaching expiration, and devices containing affected certificate versions must update them to maintain Secure Boot functionality and avoid compromising security by losing security fixes related to Windows boot manager or Secure Boot. The operating system’s certificate update protection mechanism relies on firmware components that might contain defects, which can cause certificate trust updates to fail or behave unpredictably. This leads to potential disruption of the Secure Boot trust chain and requires careful validation and deployment to restore intended security guarantees.
Certificate Authority (CA) Location Purpose Expiration Date
Microsoft Corporation KEK CA 2011 KEK Signs updates to the DB and DBX 06/24/2026
Microsoft Corporation UEFI CA 2011 DB Signs 3rd party boot loaders, Option ROMs, etc. 06/27/2026
Microsoft Windows Production PCA 2011 DB Signs the Windows Boot Manager 10/19/2026
For more information see this CVE and Windows Secure Boot certificate expiration and CA updates.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.3.9600.22968Patch KB5073696 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.14393.8783Patch KB5073722 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.2.9200.25868Patch KB5073698 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.32230Patch KB5073379 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.25398.2092Patch KB5073450 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26100.7623Patch KB5074109 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.22631.6491Patch KB5073455 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.26200.7623Patch KB5074109 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.19045.6809Patch KB5073724 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.19044.6809Patch KB5073724 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.17763.8276Patch KB5073723 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.20348.4648Patch KB5073457
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21265?
CVE-2026-21265 has a medium severity rating due to its potential for a security feature bypass.
How do I fix CVE-2026-21265?
To fix CVE-2026-21265, ensure that you apply the latest security updates provided by Microsoft for affected Windows versions.
Which Windows versions are affected by CVE-2026-21265?
CVE-2026-21265 affects multiple versions of Windows including Windows Server 2012 R2, Server 2016, Server 2019, Windows 10, and Windows 11.
What is the impact of CVE-2026-21265 if exploited?
If exploited, CVE-2026-21265 could allow unauthorized modifications to system firmware, potentially compromising system integrity.
Is there a workaround for CVE-2026-21265 until a patch is applied?
No official workaround exists for CVE-2026-21265, so applying the latest patch is the recommended solution.