A protection mechanism failure in Windows Secure Boot permits an authorized local attacker to bypass the security feature. This flaw can be exploited to load and execute unsigned or malicious code on the system, undermining the integrity of the boot process and potentially allowing privileged persistence or further compromise. The weakness is identified as CWE‑693, reflecting a failure to enforce a protection mechanism and resulting in a loss of system integrity.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations where applicable. Affected devices run the listed operating systems on x86, x64, or arm64 architectures as specified by the vendor.

The CVSS score of 7.9 indicates high severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting current exploitation probability is unclear. The attack vector is local; an attacker with authorized local access or elevated privileges can modify the boot process to bypass Secure Boot. Successful exploitation would allow the loading of unsigned firmware or boot payloads, compromising system trust. Until a publicly available exploit emerges, the primary mitigation is applying the vendor-supplied update.