CVE-2026-45654 Overview
CVE-2026-45654 is a protection mechanism failure in Windows Secure Boot that allows an authorized local attacker to bypass a security feature. The flaw is tracked under CWE-284 (Improper Access Control) and carries a CVSS 3.1 base score of 7.9. Successful exploitation undermines the integrity guarantees that Secure Boot provides during the platform boot sequence. Because the scope is changed, a compromise can affect components beyond the vulnerable subsystem, including code that runs before the operating system loads.
Critical Impact
An authenticated attacker with high privileges on a local Windows host can bypass Secure Boot, undermining boot-time integrity and enabling persistent pre-OS tampering.
Affected Products
- Microsoft Windows (Secure Boot component)
- Refer to the Microsoft Security Update CVE-2026-45654 advisory for the authoritative list of affected builds
Discovery Timeline
- 2026-06-09 - CVE-2026-45654 published to the National Vulnerability Database
- 2026-06-09 - Last updated in the NVD database
Technical Details for CVE-2026-45654
Vulnerability Analysis
The vulnerability is a protection mechanism failure in Windows Secure Boot. Secure Boot validates firmware and bootloader components against trusted signatures before allowing execution. The flaw permits an authorized local attacker to bypass that validation path, defeating the security feature it is designed to enforce. The attack vector is local and requires high privileges, but the impact crosses a security boundary, affecting components outside the immediately vulnerable subsystem. Confidentiality and integrity of boot-stage data can be fully compromised, while availability is not directly affected. EPSS currently estimates a low near-term exploitation probability, but the bypass remains attractive for adversaries seeking pre-OS persistence such as bootkits.
Root Cause
The defect maps to [CWE-284] Improper Access Control. A control surface inside the Secure Boot implementation fails to enforce its intended policy, allowing a privileged caller to influence boot validation in a way the designers did not anticipate. Microsoft has not published low-level technical details beyond the advisory description.
Attack Vector
Exploitation requires local access and existing high privileges on the target host. The attacker uses that foothold to manipulate Secure Boot state or bypass its policy enforcement. No user interaction is required. Public proof-of-concept code is not currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
No verified exploitation code is available at this time. Refer to the Microsoft Security Update CVE-2026-45654 advisory for technical details.
Detection Methods for CVE-2026-45654
Indicators of Compromise
- Unexpected changes to UEFI variables related to Secure Boot policy, including PK, KEK, db, and dbx
- New or modified bootloader binaries on the EFI System Partition that do not match vendor-signed baselines
- TPM PCR measurement deltas across reboots that cannot be tied to a known firmware or OS update
- Administrative process activity that loads kernel or boot components outside standard Windows servicing workflows
Detection Strategies
- Compare measured boot logs and TPM attestation results against a known-good baseline for each managed host
- Alert on writes to Secure Boot UEFI variables and on bcdedit or mokutil-equivalent operations performed by interactive sessions
- Correlate privileged process execution with subsequent reboots and boot configuration changes to identify staging behavior
Monitoring Recommendations
- Enable Windows Defender System Guard and Device Health Attestation, and forward attestation failures to your SIEM
- Ingest Windows Security and Microsoft-Windows-Kernel-Boot event logs for centralized analysis
- Monitor endpoints for administrative tool use that touches boot configuration, signed policy files, or firmware update utilities
How to Mitigate CVE-2026-45654
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-45654 advisory to all affected Windows systems
- Inventory hosts where local administrators or SYSTEM-level service accounts are broadly distributed and reduce that footprint
- Validate Secure Boot status across the fleet using Confirm-SecureBootUEFI and remediate any host returning False or errors
Patch Information
Microsoft has published guidance and updates through its Security Update Guide. Administrators should consult the Microsoft Security Update CVE-2026-45654 entry to identify the specific KB articles applicable to each supported Windows build and deploy them through standard servicing channels.
Workarounds
- Restrict local administrative privileges and enforce just-in-time elevation to limit the population of accounts that meet the high-privilege precondition
- Enable BitLocker with TPM and PIN so that boot tampering forces a recovery event surfaced to operators
- Update the UEFI forbidden signatures database (dbx) as Microsoft publishes revocations tied to this issue
# Verify Secure Boot state and apply pending Windows updates
Confirm-SecureBootUEFI
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
UsoClient StartScan; UsoClient StartDownload; UsoClient StartInstall
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
