{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/718077#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\nThe UEFI Shell program may expose raw memory access capabilities that, if present in platform firmware for debugging or advanced support use cases, could be abused to undermine UEFI Secure Boot protections. When the UEFI Shell is included in SPI flash, an attacker with the ability to modify UEFI boot configuration may be able to create multiple boot option entries and bypass controls intended to prevent the UEFI Shell from launching while Secure Boot is enabled. This could allow an attacker to modify the pre-boot environment and execute unauthorized software during system startup.\r\n\r\n### Description\r\nThe [Unified Extensible Firmware Interface](https://uefi.org) (UEFI) is a firmware specification that defines the interface between a computing platform's hardware and operating system (OS) during the early boot process before the operating system is loaded. UEFI Secure Boot helps ensure that only trusted and digitally signed software is executed during these early stages of platform initialization. \r\n\r\nThe [TianoCore EDK II](https://github.com/tianocore/edk2) project provides an open-source reference implementation of the UEFI and Platform Initialization (PI) specifications. The project includes the [UEFI Shell](https://uefi.org/sites/default/files/resources/UEFI_Shell_Spec_2_0.pdf), which provides command-line utilities for debugging, diagnostics, and advanced platform management. Many OEM and Independent BIOS Vendor (IBV) firmware implementations include the UEFI Shell in SPI flash for service and support purposes. Because the shell executes in the pre-boot environment, it provides powerful commands such as `dmem` (display memory) and `mm` (memory modify) that can access physical memory. Many implementations include a boot entry for the UEFI Shell but remove or suppress it when Secure Boot is enabled to reduce the risk of misuse.\r\n\r\nA vulnerability disclosed by Eclypsium researcher Stas Lyakhov details a technique in which an attacker with the ability to create additional UEFI boot entries can reference the UEFI Shell even when standard controls are implemented to prevent its execution. An attacker could then exploit the UEFI Shell and its startup scripting capabilities to modify the pre-boot environment, including overwriting Secure Boot-related memory values, and execute unauthorized code during the early boot process.\r\n\r\n### Impact\r\nAn attacker capable of modifying UEFI boot entries may be able to circumvent intended Secure Boot protections and execute arbitrary code before the operating system loads. Code executed during the pre-boot phase may establish persistent access, including the ability to load malicious boot components or kernel-level software that can survive both system reboots and, in some cases, reinstallation of the operating system. Such activity may also reduce the effectiveness of OS-based security controls and endpoint detection and response (EDR) solutions.\r\n\r\n### Solution\r\n#### Apply a Patch\r\nPlease see the Vendor Information section for responses from vendors that have released updates addressing this issue. Updating UEFI firmware may require OEM-specific tools and deployment processes, as firmware updates are often managed separately from operating system patch management. Follow the guidance provided by your platform vendor when applying firmware updates.\r\n\r\n#### Recommendations for Enterprises \r\nOrganizations should review Secure Boot configuration and platform security policies to help prevent or detect unauthorized modifications to UEFI boot entries. Changes to boot configuration should be monitored and audited where possible. Enterprises that use independent endpoint management solutions should consult their OEM vendors for guidance on integrating UEFI firmware updates into their existing firmware lifecycle and patch management processes.\r\n\r\n### Acknowledgements\r\nThanks to Stas Lyakhov from Eclypsium for reporting this vulnerability. This document was written by Vijay Sarvepalli.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"},{"category":"other","text":"AMI is affected by this issue.","title":"Vendor statment from American Megatrends Incorporated (AMI)"},{"category":"other","text":"Insyde believes this issue is based on a vulnerability in the upstream TianoCore codebase. We believe most of our customers and the majority of devices shipping with Insyde BIOS are not affected because they do not include the shell in the system code areas that are approved to execute without being signed during Secure Boot. However, there are a subset of customers that have chosen to include shell for their own reasons and may be affected.\r\n\r\nThe vulnerabiity is tracking by CVE-2026-6485 which is created by Insyde.\r\nCVSS Score: 8.2 (serious)\r\nCVSS Vector string: 3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\r\nPublic date is set on July 8 2026.","title":"Vendor statment from Insyde Software Corporation"},{"category":"other","text":"Confirmed vulnerability in AMI Aptio UEFI BDS module. A logic error in the Shell boot option removal process allows an attacker with root privileges to create multiple boot entries, bypassing the Secure Boot check and gaining access to the UEFI Shell. This enables arbitrary physical memory read/write, leading to a full Secure Boot bypass.\r\n\r\n\r\nSolution Implementation: Integrating the security patch provided by AMI into the BIOS build pipeline.\r\nVerification: Verified the fix by attempting to create redundant Shell boot options; confirmed that the updated BDS module now removes all matching entries.\r\nDeployment: BIOS update scheduled for public release before 2026-07-14.","title":"Vendor statment from GIGABYTE"},{"category":"other","text":"Cisco UCS Servers and UCS-based appliances are affected by a variation of this UEFI Shell issue. Cisco has assigned CVE-2026-20293 and published a security advisory for the issue. Refer to the security advisory for additional details: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-uefi-sb-bypass-eb6xC5GW\r\nOther Cisco products do not rely on UEFI Secure Boot as part of their hardware chain of trust.","title":"Vendor statment from Cisco"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/718077"},{"url":"https://www.uefi.org/","summary":"https://www.uefi.org/"},{"url":"https://uefi.org/sites/default/files/resources/UEFI_Shell_Spec_2_0.pdf","summary":"https://uefi.org/sites/default/files/resources/UEFI_Shell_Spec_2_0.pdf"},{"url":"https://eclypsium.com/blog/bombshell-the-signed-backdoor-hiding-in-plain-sight-on-framework-devices/","summary":"https://eclypsium.com/blog/bombshell-the-signed-backdoor-hiding-in-plain-sight-on-framework-devices/"}],"title":"UEFI Shell module embedded in SPI Flash can be used to bypass Secure Boot","tracking":{"current_release_date":"2026-09-08T15:05:58+00:00","generator":{"engine":{"name":"VINCE","version":"3.0.45"}},"id":"VU#718077","initial_release_date":"2026-09-08 15:05:58.068772+00:00","revision_history":[{"date":"2026-09-08T15:05:58+00:00","number":"1.20260908150558.1","summary":"Released on 2026-09-08T15:05:58+00:00"}],"status":"final","version":"1.20260908150558.1"}},"vulnerabilities":[{"title":"A vulnerability in AMI APTIO UEFI BDS module may allow access to the UEFI Shell, enabling Secure Boot bypass via shell commands or startup scripts.","notes":[{"category":"summary","text":"A vulnerability in AMI APTIO UEFI BDS module may allow access to the UEFI Shell, enabling Secure Boot bypass via shell commands or startup scripts."}],"cve":"CVE-2026-33197","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#718077"}],"product_status":{"known_affected":["CSAFPID-899abb9e-aba6-11f1-b9a2-0affc57a791d","CSAFPID-899b5fd6-aba6-11f1-b9a2-0affc57a791d"],"known_not_affected":["CSAFPID-899ae678-aba6-11f1-b9a2-0affc57a791d","CSAFPID-899b0c20-aba6-11f1-b9a2-0affc57a791d","CSAFPID-899b3ad8-aba6-11f1-b9a2-0affc57a791d","CSAFPID-899b8178-aba6-11f1-b9a2-0affc57a791d"]}},{"title":"Insyde implementation of UEFI BDS module allows for UEFI shell to be evoked to bypass Secure Boot settings.","notes":[{"category":"summary","text":"Insyde implementation of UEFI BDS module allows for UEFI shell to be evoked to bypass Secure Boot settings"}],"cve":"CVE-2026-6485","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#718077"}],"product_status":{"known_affected":["CSAFPID-899bf07c-aba6-11f1-b9a2-0affc57a791d"],"known_not_affected":["CSAFPID-899bcaa2-aba6-11f1-b9a2-0affc57a791d","CSAFPID-899c1ba6-aba6-11f1-b9a2-0affc57a791d"]}},{"title":"Cisco implementation of UEFI BDS module allows for UEFI shell to be evoked to bypass Secure Boot settings.","notes":[{"category":"summary","text":"Cisco implementation of UEFI BDS module allows for UEFI shell to be evoked to bypass Secure Boot settings"}],"cve":"CVE-2026-20293","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#718077"}],"references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-uefi-sb-bypass-eb6xC5GW","summary":"Cisco UCS Servers and UCS-based appliances are affected by a variation of this UEFI Shell issue. Cisco has assigned CVE-2026-20293 and published a security advisory for the issue. Refer to the security advisory for additional details: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-uefi-sb-bypass-eb6xC5GW","category":"external"}],"product_status":{"known_affected":["CSAFPID-899c79f2-aba6-11f1-b9a2-0affc57a791d"]}}],"product_tree":{"branches":[{"category":"vendor","name":"American Megatrends Incorporated (AMI)","product":{"name":"American Megatrends Incorporated (AMI) Products","product_id":"CSAFPID-899abb9e-aba6-11f1-b9a2-0affc57a791d"}},{"category":"vendor","name":"Intel","product":{"name":"Intel Products","product_id":"CSAFPID-899ae678-aba6-11f1-b9a2-0affc57a791d"}},{"category":"vendor","name":"Insyde Software Corporation","product":{"name":"Insyde Software Corporation Products","product_id":"CSAFPID-899b0c20-aba6-11f1-b9a2-0affc57a791d"}},{"category":"vendor","name":"Phoenix Technologies","product":{"name":"Phoenix Technologies Products","product_id":"CSAFPID-899b3ad8-aba6-11f1-b9a2-0affc57a791d"}},{"category":"vendor","name":"GIGABYTE","product":{"name":"GIGABYTE Products","product_id":"CSAFPID-899b5fd6-aba6-11f1-b9a2-0affc57a791d"}},{"category":"vendor","name":"Cisco","product":{"name":"Cisco Products","product_id":"CSAFPID-899b8178-aba6-11f1-b9a2-0affc57a791d"}},{"category":"vendor","name":"Intel","product":{"name":"Intel Products","product_id":"CSAFPID-899bcaa2-aba6-11f1-b9a2-0affc57a791d"}},{"category":"vendor","name":"Insyde Software Corporation","product":{"name":"Insyde Software Corporation Products","product_id":"CSAFPID-899bf07c-aba6-11f1-b9a2-0affc57a791d"}},{"category":"vendor","name":"Cisco","product":{"name":"Cisco Products","product_id":"CSAFPID-899c1ba6-aba6-11f1-b9a2-0affc57a791d"}},{"category":"vendor","name":"Cisco","product":{"name":"Cisco Products","product_id":"CSAFPID-899c79f2-aba6-11f1-b9a2-0affc57a791d"}}]}}