Multiple Microsoft-sigend UEFI SHIM bootloaders are vulnerable to a SecureBoot bypass. An attacker with administrative privileges or the ability to modify the boot process could deploy a malicious shim to bypass Secure Boot protections and execute arbitrary code before the operating system loads. The flaw effectively disables the security benefits of SecureBoot, allowing code signed with the vulnerable shim to run unimpeded. A specific UEFI DBX update is required to block these vulnerable boot loaders.

The affected vendors and products include Baramundi Management Suite, WhiteCanyon WipeDrive, Abitti 1, RosaLinux, OracleLinux(7.2) shim, various PC‑Doctor Linux Diagnostics tools, and Spyrus WTGCreator. Current data does not specify affected version ranges, but all versions running Microsoft‑signed UEFI SHIM loading mechanisms at the time of discovery are considered vulnerable. A specific UEFI DBX firmware update that removes the vulnerable shim binaries is the recommended fix.

The CVSS score is 7.8, and the EPSS score is unavailable, meaning the exploitation likelihood is not quantified. The vulnerability appears to be a design flaw in the shim’s signature validation, categorized as a failure to enforce SecureBoot policy. Attackers need either administrative rights on the host or physical access to modify the boot configuration to deploy the malicious shim. Once the shim is trusted by the firmware, the attacker can run arbitrary code with kernel privileges, constituting a high‑impact credential‑bypass scenario. The CVE is not listed in the CISA KEV catalog, but the severity suggests that any impacted system should treat it as a critical threat.