Microsoft
UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?
At a glance
Low rather than Medium: UK relevance is 40 of 100, little UK-specific signal so far.
Briefing
- Business leaders should consider how UEFI bootkits could compromise system integrity before security defences are active.
- IT teams should verify if their estate is exposed to UEFI bootkit threats that could bypass Secure Boot protections.
Next steps
Monitor- For awareness — no fixed action deadline for this reporting
- The UEFI bootkit bypassed Secure Boot protections on Windows 11 systems, allowing malicious code to run before Windows was fully loaded.
Next steps
Monitor- No immediate technical action — track if your estate depends on the products or vendors discussed
Summary
- A UEFI bootkit named BlackX has been reported to have infected fully patched Windows machines, exploiting Microsoft's lack of clarity around Secure Boot protections.
- In 2023, BlackLotus became the first publicly documented UEFI bootkit capable of bypassing Secure Boot on fully updated Windows 11 systems by subverting the chain-of-trust mechanism.
Read the original reportArs Technica Security(opens in a new tab)
Part of Microsoft Windows Video ActiveX Control Vulnerability
- Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability
- Microsoft named a Leader in the 2026 Gartner® Magic Quadrant™ for AI Agent Management Platforms
- Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities
- Path Traversal in .NET allows an authorized attacker to elevate privileges locally
Pulse
Last change 5d ago · Recheck overdue since 4 Nov 2026, 16:27 UK time
- Story3 Nov 2026, 16:27 UK time · 5d ago
Linked reporting from Ars Technica Security (independent original reporting).
Read source (Ars Technica Security)
1 entry so far. The timeline chart appears once this story has more history.
Sources
- Ars Technica SecurityNews
UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?
- ProbableSummary fact75% confidence
UEFI bootkit BlackX exploits Microsoft's lack of clarity around Secure Boot protections. In 2023, malware tracked as BlackLotus became the first publicly documented in-the-wild UEFI bootkit capable of bypassing Secure Boot on fully updated Windows 11 systems. With the industry-wide chain-of-trust mechanism subverted, the malware was able to run malicious code before Windows was fully loaded and many security defences were operational.