Cybersecurity researchers at ESET have identified eleven (11) outdated, Microsoft-signed UEFI shim bootloaders that attackers could abuse to bypass Secure Boot and execute malicious code before the operating system or endpoint security tools initialize. The vulnerable applications, primarily based on shim version 0.9 or earlier, remain trusted on UEFI systems that recognize Microsoft’s legacy “Microsoft Corporation UEFI CA 2011” certificate and can be used in a bring-your-own-vulnerable-driver (BYOVD)-style attack to deploy persistent UEFI bootkits such as Bootkitty, HybridPetya, or BlackLotus. An attacker with administrative privileges or the ability to modify the boot process could replace a current shim with an older, still-trusted Microsoft-signed version, bypass Machine Owner Key (MOK) denylist enforcement and Secure Boot Advanced Targeting (SBAT) protections and execute arbitrary code during the early boot phase. This pre-OS execution can establish deeply entrenched persistence capable of surviving system reboots, and, in some cases, operating system reinstalls while also evading endpoint detection and response (EDR) tools. The issues, tracked as CVE-2026-8863 and CVE-2026-10797, stem largely from vulnerable vendor-specific bootloaders remaining signed and trusted long after flaws in the upstream shim project were publicly disclosed and fixed, creating a long-term software supply chain exposure. Microsoft revoked the affected bootloaders as part of its June 2026 Patch Tuesday updates, but researchers warn that the expiration of the legacy 2011 UEFI CA certificate alone does not prevent previously signed binaries from executing unless they are explicitly revoked, highlighting how old but trusted components can undermine Secure Boot without requiring attackers to exploit a newly discovered vulnerability. CTIX analysts strongly urge supply chain Microsoft administrators to ensure they have implemented the most recent patches and conduct internal investigations to ensure there hasn’t already been a compromise.