Windows Secure Boot Certificate Expiration Security Feature Bypass
CVE-2026-21265 is a Windows Secure Boot security feature bypass issue tied to expiration of Microsoft Secure Boot certificates originally issued in 2011 and stored in UEFI trust databases, including the KEK and DB. The affected certificates include Microsoft Corporation KEK CA 2011, Microsoft Corporation UEFI CA 2011, and Microsoft Windows Production PCA 2011, which are used to sign Secure Boot trust updates, third-party boot loaders and option ROMs, and the Windows Boot Manager. If devices continue relying on these expiring certificates without receiving the updated certificate material, Secure Boot trust decisions can fail or become inconsistent. Microsoft also notes that the OS certificate update protection mechanism depends on firmware components that may contain defects, causing certificate trust updates to fail or behave unpredictably. The net effect is a weakening or disruption of the Secure Boot trust chain that can permit bypass of intended boot-time trust enforcement.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Windows Secure Boot certificate update/expiration issue labeled as a security feature bypass; primarily a reliability/maintainability security prerequisite with minimal direct attack vector described.
A Microsoft-reported critical zero-day vulnerability addressed in the January 2026 Patch Tuesday release; specific technical details are not provided in the content.
A Secure Boot security feature bypass related to expiring Secure Boot certificates, potentially undermining the trust mechanism for firmware modules.
An issue related to Secure Boot certificate expiration (certificates issued in 2011) that can cause systems to stop trusting new boot loaders or fail to receive future security updates if not updated in time; not described as immediate exploitation.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.