Bypass Record
Pre-OS Boot × Microsoft Windows Secure Boot
A publicly-reported instance of Pre-OS Boot bypassing Microsoft Windows Secure Boot, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
The vulnerability allows loading of revoked or malicious bootloaders due to flaws in Secure Boot's validation logic. An attacker with local admin rights can replace legitimate EFI boot files (e.g., bootmgfw.efi) with a malicious version, which the system fails to block, enabling pre-OS malware execution that evades endpoint security products.
Detection & mitigation
Monitor for unexpected changes to EFI system partition files (e.g., bootmgfw.efi) and validate bootloader integrity using TPM measurements or Secure Boot logs. Apply Microsoft's updated blocklists and patches to prevent loading of revoked bootloaders.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.