UEFI bootkit infected fully patched Windows machines
BlackX UEFI bootkit bypassed Secure Boot on fully updated Windows 11 systems three years after the original BlackLotus discovery.
Stories per day · 30 days
1 RSS
Relatedsecure-boot12bootkit8firmware8pxe8apt417blackx6edk-ii6blacklotus3edk23pre-boot3baton-drop2buffer-overflow2windows2bootloader1cisa-advisory1cloudflare1data-leak1diplomacy1
23 stories, newest first · one card per story
Stories tagged #uefi
Metis fuzzing discovers 137 bugs in UEFI edk2 bootloader protocols
Metis rehosts edk2 protocols as user-space applications and achieves 73.1 percent coverage, 1.7 times higher than FuzzUEr, reporting 26 previously unknown bugs to vendors.
Roundup: UEFI boot flaw, Anthropic access dispute, Cloudflare AI leak
The digest also covers suspected freezer tampering, an FEC filing outage, and breaches at Copenhagen and ENGIE.
EDK II UEFI flaw CVE-2026-97631 can run code before the OS
A 16-year-old PXE ICMP buffer overflow, rated 9.5, was disclosed early after AMI published a fix.
CVE-2026-97631: unauthenticated pre-boot RCE in EDK II PXE driver
An attacker on the network can execute code during IPv4 or IPv6 PXE boot via ICMP error messages, affecting UEFI firmware on many servers.
16-year-old EDK II PXE buffer overflow runs code before Secure Boot
CVE-2026-97631 lets an adjacent-network attacker hang or hijack network boots on servers, and no stable EDK II release ships the fix yet.
CVE-2026-97631 lets attackers run code before the OS on EDK II PXE boots
An unauthenticated ICMP sender can overflow a 504-byte field during PXE boot; AMI’s fix surfaced early and affected devices remain unclear.
EDK II PXE boot flaw can run code before the OS loads (CVE-2026-97631)
Oversized ICMP errors can corrupt firmware memory only while a machine is PXE-booting; TianoCore merged a fix on October 15.
EDK II PXE flaw CVE-2026-97631 allows pre-boot code execution
One ICMP error during network boot can crash the client or, on a known build, run code before Secure Boot; vendor updates are still pending.
EDK2 UEFI bug CVE-2026-97631 enables pre-boot code execution
A 16-year-old buffer overflow in the PXE ICMP parser scores 9.5; an early AMI patch made the bug public before the planned January disclosure.
BlackX bootkit bypasses Windows Secure Boot in Central Asia attacks
Securelist says fully patched PCs stayed exposed because boot-certificate revocations were incomplete; the APT41 link is only medium confidence.
1
BlackX UEFI bootkit found on fully patched Windows PCs in Central Asia
Kaspersky says the Secure Boot revocation that would block Baton Drop stays off unless an admin enables KB5025885 by hand.
BlackX bootkit uses Baton Drop to bypass Secure Boot
Kaspersky says fully patched Windows stayed exposed unless admins manually applied Secure Boot certificate revocations.
BlackX UEFI bootkit bypasses Secure Boot where DBX revocations are missing
Kaspersky says suspected APT41 used the BlackLotus-like bootkit on diplomats in three Central Asian countries after gaining administrator access.
BlackX bootkit uses Baton Drop to bypass Secure Boot
Securelist says infected diplomatic systems had Windows updates but not the certificate revocation that blocks CVE-2022-21894.
2
Suspected APT41 uses BlackX bootkit against Central Asian diplomats
Kaspersky says BlackX abuses unrevoked CVE-2022-21894 components on patched Windows when Secure Boot DBX updates are not applied.
Siemens SIMATIC IPCs allow UEFI Secure Boot bypass (CVE-2026-72895)
Physical access attackers can boot arbitrary OS signed with AMI test key; fixes released for BX-21A, RW-543A, and IPC227G series.
APT41-linked BlackX bootkit hits Central Asian diplomatic agencies
After gaining admin rights, attackers exploit CVE-2022-21894 to load a kernel driver and a cloud-backed RAT.
VU#738147: Vendor-signed UEFI Shell applications allow Secure Boot bypass
CERT warns vendor-signed UEFI shells from Acer, Dell, and others can bypass Secure Boot.
2
GNU GRUB 2.14: serial-MMIO lockdown bypass in Canonical-signed gcdx64.efi
Canonical-signed GRUB2 serial command accepts arbitrary MMIO addresses, letting local attackers with grub.cfg control bypass Secure Boot lockdown.
VU#687587: AOMEI Backupper amwrtdrv.sys local privilege escalation vulnerability allows arbitrary writes to physical disks
AOMEI Backupper 8.4.0 driver flaw CVE-2026-12780 lets unprivileged users write physical disks and execute UEFI code, bypassing HVCI and EDR.
2
Cisco UCS and UCS-Based Appliances UEFI Shell Secure Boot Bypass Vulnerability
Cisco disclosed a UEFI Secure Boot bypass in UCS servers and UCS-based appliances letting authenticated or physically present attackers execute unauthorized software.
VU#718077: UEFI Shell module embedded in SPI Flash can be used to bypass Secure Boot
CERT/CC details VU#718077: UEFI Shell embedded in SPI flash lets attackers bypass Secure Boot and execute pre-boot code; patches issued.