Security Advisory regarding UEFI Secure Boot Bypass Vulnerability

ESET research has recently disclosed a vulnerability (CVE-2026-8863) affecting several third-party UEFI shim bootloaders signed by the "Microsoft Corporation UEFI CA 2011" certificate. Due to a lack of sufficient verification mechanisms (SBAT) in these older shim versions, an attacker could potentially bypass Secure Boot protections by employing a "Bring Your Own Vulnerable Driver/Binary" (BYOVD) technique to execute unauthorized code during the early boot phase.

GIGABYTE's security team has conducted a comprehensive assessment across our product lines, including motherboards and laptops. The findings are as follows:

1. Firmware Integrity: We have verified that GIGABYTE BIOS implementations do not bundle any of the affected third-party shim bootloader binaries. Therefore, GIGABYTE firmware does not contain the vulnerable code.

2. Risk Analysis: Because the industry-standard Secure Boot mechanism widely trusts the Microsoft Corporation UEFI CA 2011 certificate, systems that have not updated their UEFI DBX (Forbidden Signature Database) may still be susceptible to attacks where a vulnerable shim is introduced from an external source (e.g., via a USB boot device).

The definitive resolution for this vulnerability is to update the UEFI DBX blacklist to revoke the trust of the affected binaries. We recommend users take the following actions:

•OS Updates: Ensure your operating system is updated with the latest security patches for June 2026. Microsoft will distribute the DBX revocation list through standard OS update channels.

•Firmware Updates: GIGABYTE is working closely with our partners (AMI/Microsoft) to integrate the latest DBX updates into our future BIOS releases. We encourage users to regularly check the GIGABYTE official website for the latest BIOS updates.

•Security Best Practices: We recommend keeping Secure Boot enabled and avoiding the execution of bootable devices from untrusted sources.

GIGABYTE remains committed to monitoring global security trends and providing the highest level of hardware security protection.

*The release schedule may be adjusted without further notification. Please check this page or contact technical support for any future updates.

*For any further assistance regarding this issue please contact your sales representative, or create a new support ticket at https://esupport.gigabyte.com