CVE-2026-48578
HighCVSS 7.9Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
Windows Secure Boot has an improper access control vulnerability that allows an authorized attacker to elevate privileges locally.
Risk Assessment
An attacker can bypass Secure Boot security mechanisms and gain higher privileges, potentially leading to malware installation at the bootloader level.
Recommendation
Apply the security update from Microsoft that fixes the access control in Secure Boot.
Other vulnerabilities in Windows Secure Boot
See all- CVE-2026-49783High
Improperly implemented security check for Secure Boot in Windows allows an authorized attacker to bypass a security feature locally.
- CVE-2026-48576High
A vulnerability in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.
- CVE-2026-48575High
A protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.
- CVE-2026-48573High
A vulnerability in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.
- CVE-2026-48570High
A protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.
- CVE-2026-48568High
A protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.
- CVE-2026-45654High
Improper access control in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.
- CVE-2026-45588High
A protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.
- CVE-2026-21265Medium
The vulnerability involves expiring Microsoft certificates in Secure Boot. Failure to update them may cause loss of Secure Boot functionality and protection against malware. The update process can be disrupted by firmware defects.
Original NVD description (English source)
Improper access control in Windows Secure Boot allows an authorized attacker to elevate privileges locally.