The vulnerability arises from defects in the firmware that protects the Windows Secure Boot certificate update process. When the operating system attempts to refresh Microsoft certificates that are approaching expiration, the flawed mechanism can fail or behave unpredictably. This failure can break the Secure Boot trust chain and prevent the system from maintaining the integrity and availability guarantees of the boot process, potentially causing devices to lose security updates for the boot manager or Secure Boot itself.

Affected systems include Windows 10 variants 1607, 1809, 21H2, and 22H2; Windows 11 variants 23H2, 24H2, 25H2, and 22H3; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, 2025, and the 23H2 edition. All systems that rely on UEFI Secure Boot and still use certificates approaching their expiration dates (June 2026 for the KEK and UEFI CAs, October 2026 for the Windows Boot Manager CA) are susceptible to this defect.

The CVSS score of 6.4 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require privileged or administrative access to modify firmware or deliver a malicious update that triggers the certificate validation failure. Without such access, the risk remains limited, but organizations should act promptly to apply vendor updates to maintain Secure Boot integrity.