Researchers Find 11 Microsoft‑Signed UEFI Apps That Can Bypass Secure Boot

Security researchers uncovered 11 legacy Microsoft‑signed Unified Extensible Firmware Interface (UEFI) applications that can be abused to bypass Secure Boot on most modern firmware systems. An attacker exploiting one of these vulnerable applications can execute untrusted code during system boot, enabling the deployment of malicious UEFI bootkits or other malware. The findings highlight a critical weakness in the firmware signing process, where outdated applications remain signed and trusted by the firmware. The vulnerability allows attackers to load malicious code before the operating system boots, effectively circumventing the Secure Boot protection that is designed to prevent unauthorized firmware execution. The research team demonstrated how the bypass could be achieved on a variety of hardware platforms, including consumer laptops and enterprise servers. Microsoft has not yet released a patch for these specific UEFI applications, but the discovery urges vendors to update firmware and remove legacy signed components. The issue underscores the need for continuous firmware maintenance and the removal of unused or outdated signed binaries. The researchers recommend that organizations verify the integrity of their firmware and consider disabling legacy UEFI modes to mitigate the risk.

The discovery is a significant security concern for any organization that relies on Secure Boot to protect against boot‑time attacks. It also raises questions about the long‑term viability of signed firmware components that are no longer actively maintained. The vulnerability demonstrates how attackers can leverage seemingly benign, signed binaries to compromise system integrity from the earliest stages of the boot process.