CVE-2026-8863
CVE-2026-8863

7.8HIGH

Key Information:

Vendor

Oracle
Status
Oraclelinux(7.2) Shim
Service Center Enterprise
Service Center Drive Erase
Service Center Japan
Vendor
CVE Published:
9 June 2026

What is CVE-2026-8863?

Multiple Microsoft-sigend UEFI SHIM bootloaders are vulnerable to SecureBoot bypass. An attacker with administrative privileges or the ability to modify the boot process could use one of the vulnerable shim bootloaders to bypass Secure Boot protections and execute arbitrary code before the operating system loads. Specific UEFI DBX update is required to block these vulnerable boot loaders.

Affected Version(s)

Abitti 1 1.0.0

Baramundi Management Suite * <= 2024R1

Factory for Linux (Bootable Diagnostics) 6.9 <= 6.20.7710.267

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisory
https://kb.cert.org/vuls/id/616257
third-party-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks to Martin Smolar of ESET for discovering and reporting this vulnerability
.