CVE-2024-26189 Overview
CVE-2024-26189 is a Secure Boot security feature bypass vulnerability affecting supported versions of Microsoft Windows and Windows Server. The flaw stems from improper input validation [CWE-20] in the Secure Boot boot chain, enabling an attacker with adjacent network access and user interaction to bypass boot integrity checks. Successful exploitation impacts confidentiality, integrity, and availability of the host. Microsoft addressed the issue in the April 2024 security update cycle. See the Microsoft Security Update CVE-2024-26189 advisory for vendor guidance.
Critical Impact
Bypassing Secure Boot allows unauthorized firmware or boot-stage code to execute before the operating system loads, undermining a foundational integrity control on Windows endpoints and servers.
Affected Products
- Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (21H2, 22H2, 23H2)
- Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2022 23H2
Discovery Timeline
- 2024-04-09 - CVE-2024-26189 published to the National Vulnerability Database
- 2024-04-09 - Microsoft releases security update addressing the vulnerability
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-26189
Vulnerability Analysis
CVE-2024-26189 is classified as a Secure Boot Bypass caused by improper input validation [CWE-20] within a boot-time component. Secure Boot is a Unified Extensible Firmware Interface (UEFI) feature that verifies signatures of firmware modules, bootloaders, and the operating system loader before execution. When validation logic accepts malformed or crafted input, an attacker can substitute components that would normally fail signature or integrity checks.
Exploitation requires adjacent network access and user interaction, which typically means an attacker on the same logical network segment combined with a victim executing a crafted file or connecting to attacker-controlled boot media. A successful bypass allows code to run in the pre-OS environment where standard operating system controls, endpoint agents, and event logging are not yet active.
The impact extends beyond a single boot cycle. Boot-stage payloads such as bootkits can persist across operating system reinstalls, evade file-based scanning, and undermine trust in downstream measurements used by BitLocker and remote attestation.
Root Cause
The root cause is improper validation of input processed during the Secure Boot verification path. Insufficient checks permit boot components that should be rejected to load and execute, breaking the chain of trust anchored in UEFI.
Attack Vector
The attack vector is adjacent (AV:A) with low complexity but requires user interaction. A plausible scenario involves an attacker on the local network staging a malicious bootable image, boot-time driver, or update payload that a user is induced to install or boot from. Refer to the Microsoft Security Update CVE-2024-26189 advisory for authoritative technical detail.
// No verified public exploit code is available for CVE-2024-26189.
// Refer to the Microsoft advisory for technical guidance.
Detection Methods for CVE-2024-26189
Indicators of Compromise
- Unexpected changes to UEFI variables, the EFI System Partition, or entries in the boot configuration data (BCD) store.
- Unsigned or unexpected .efi binaries present under \EFI\Microsoft\Boot\ or vendor boot directories.
- BitLocker recovery prompts or Trusted Platform Module (TPM) PCR measurement changes without a corresponding authorized firmware or OS update.
Detection Strategies
- Compare measured boot logs and TPM PCR values against a known-good baseline to identify tampering in the pre-OS environment.
- Monitor Windows event logs for Secure Boot related events, including Microsoft-Windows-TPM-WMI and Microsoft-Windows-Kernel-Boot sources.
- Use firmware integrity tools such as the Windows Defender Offline scanner and vendor UEFI validation utilities to detect bootkit artifacts.
Monitoring Recommendations
- Centralize boot integrity, TPM attestation, and Windows Update telemetry to correlate anomalies across the fleet.
- Alert on hosts reporting Secure Boot as disabled when policy requires it to be enabled.
- Track patch compliance for the April 2024 Windows security updates across all affected Windows and Windows Server SKUs.
How to Mitigate CVE-2024-26189
Immediate Actions Required
- Apply the April 2024 Microsoft security updates for all affected Windows 10, Windows 11, and Windows Server versions listed in the Microsoft advisory.
- Verify that Secure Boot is enabled in UEFI firmware settings on every managed endpoint and server.
- Enroll systems in measured boot and remote attestation where available to detect pre-OS tampering.
Patch Information
Microsoft released fixes as part of the April 9, 2024 Patch Tuesday cycle. Administrators should consult the Microsoft Security Update CVE-2024-26189 page for the specific KB article and update package that corresponds to each affected Windows and Windows Server build.
Workarounds
- Restrict which users can boot from removable media and disable USB boot in firmware where operationally feasible.
- Enforce BitLocker with TPM+PIN so that Secure Boot tampering triggers recovery prompts and blocks silent boot-chain modification.
- Segment adjacent networks and require authenticated access to update infrastructure to reduce exposure to the adjacent attack vector.
# Verify Secure Boot status on a Windows host
Confirm-SecureBootUEFI
# Review measured boot and TPM PCR values
Get-Tpm
Get-WinEvent -LogName Microsoft-Windows-Kernel-Boot/Operational
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
