VU#616257: Microsoft-signed UEFI shim bootloaders vulnerable to Secure Boot bypass
2026-06-10T08:52:11Z•e3aed5d6d8169b1415d95491dc1d3f4e621708964ce4fe8095401051f2ce34a1
AppsmithBYOVDChrome extensionCodeMirrorCollibraDBXIMSIPsecRCE potential','Windows kernel driver','missing-access-control',SIPSecure BootUEFIVoLTEXSSZip-Slipaccess-controlautocompletecleartext-HTTPhardcoded-keysintegritypath-traversalshimstored-XSSunauthenticated-restweak-cryptography
What happened
This collection summarizes multiple distinct vulnerabilities disclosed by CERT/CC affecting boot firmware, browser extensions, telecom signaling, web platforms, enterprise agents, kernel drivers, and IAM software. Notable issues include: Microsoft‑signed UEFI shim bootloaders (pre‑0.9) susceptible to Secure Boot bypass via BYOVD-style techniques (to be mitigated by DBX revocation); a Securly Chrome Extension (v3.0.7) with cleartext HTTP fetching, hardcoded AES keys, and unauthenticated endpoints (CVE-2026-8874/8876/8878/8879); Verizon VoLTE IMS deployments observed without IPsec ESP integrity,
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- certcc_vulnotes
- Record identifier
- e3aed5d6d8169b1415d95491dc1d3f4e621708964ce4fe8095401051f2ce34a1
- Enrichment time
- 2026-06-10T08:52:11Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.