Security researcher Alon Leviev has uncovered a critical vulnerability in Windows systems, allowing attackers to bypass Microsoft’s Driver Signature Enforcement (DSE) by downgrading critical kernel components, even on fully patched systems. This technique involves hijacking the Windows Update process to roll back secure OS components, replacing them with outdated, unpatched versions. Using a tool called “Windows Downdate,” attackers can reintroduce fixed vulnerabilities, rendering the term “fully patched” meaningless. This bypass enables loading unsigned kernel drivers, paving the way for custom rootkits that can disable security controls, hide activity, and persist undetected. Leviev presented this technique, named “ItsNotASecurityBoundary,” at BlackHat and DEFCON, demonstrating how the attack manipulates components like “ci.dll” to bypass DSE and exploit root-level privileges. Although Microsoft addressed two (2) related vulnerabilities (CVE-2024-21302 and CVE-2024-38202), they have not yet fully addressed the Windows Update takeover, citing it as outside a defined security boundary. The vulnerability is further exacerbated by the ability to disable Virtualization-Based Security (VBS) if improperly configured, which otherwise protects critical assets like the secure kernel. Microsoft is developing a solution, though it requires rigorous testing for compatibility and stability across versions. Leviev’s findings underscore the urgent need for defenses against downgrade attacks, as this technique bypasses traditional security boundaries, putting systems at substantial risk. To mitigate this flaw for now, users must ensure that VBS is enabled with UEFI lock and the Mandatory flag set. CTIX analysts urge administrators to follow the mitigation techniques for now and monitor for when a permanent fix is released.