{"id":"CVE-2023-24932","published":"2023-05-09T17:03:07Z","modified":"2025-07-10T16:39:08Z","title":"Secure Boot Security Feature Bypass Vulnerability","vendor":"Microsoft","product":"Windows Server 2025 (Server Core installation)","tier":"core","eol":null,"affectedVersions":[{"vendor":"Microsoft","product":"Windows Server 2025 (Server Core installation)","versions":[">= 10.0.26100.0, < 10.0.26100.4652"]},{"vendor":"Microsoft","product":"Windows 11 Version 24H2","versions":[">= 10.0.26100.0, < 10.0.26100.4652"]},{"vendor":"Microsoft","product":"Windows Server 2025","versions":[">= 10.0.26100.0, < 10.0.26100.4652"]},{"vendor":"Microsoft","product":"Windows 10 Version 1809","versions":[">= 10.0.17763.0, < 10.0.17763.7558"]},{"vendor":"Microsoft","product":"Windows 10 Version 1809","versions":[">= 10.0.0, < 10.0.17763.6054"]},{"vendor":"Microsoft","product":"Windows Server 2019","versions":[">= 10.0.17763.0, < 10.0.17763.7558"]},{"vendor":"Microsoft","product":"Windows Server 2019 (Server Core installation)","versions":[">= 10.0.17763.0, < 10.0.17763.7558"]},{"vendor":"Microsoft","product":"Windows Server 2022","versions":[">= 10.0.20348.0, < 10.0.20348.3932"]},{"vendor":"Microsoft","product":"Windows 10 Version 20H2","versions":[">= 10.0.0, < 10.0.19042.2965"]},{"vendor":"Microsoft","product":"Windows 11 version 21H2","versions":[">= 10.0.22000.0, < 10.0.22000.3079"]}],"description":{"text":"Secure Boot Security Feature Bypass Vulnerability","provenance":"source","from":"CVE.org"},"summary":{"text":"A Secure Boot security feature bypass vulnerability in Microsoft Windows Server 2025 (Server Core installation), classified under the weakness \"Incorrect Authorization\". An attacker with local access and high privileges can exploit it without any user interaction to bypass Secure Boot protections.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T22:22:11Z"},"cvss":{"score":6.7,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.11819,"percentile":0.96088,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2023-05-09","exploitedFirstSeen":"2023-05-09","ransomware":false,"evidence":[{"url":"https://msrc.microsoft.com/blog/2023/05/guidance-related-to-secure-boot-manager-changes-associated-with-cve-2023-24932/","date":"2023-05-09"},{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2023-May","date":"2023-07-18"},{"url":"https://securelist.com/it-threat-evolution-q2-2023-non-mobile-statistics/110413/","date":"2023-08-30"},{"url":"https://go.recordedfuture.com/hubfs/reports/ta-2024-0321.pdf","date":"2024-03-21"},{"url":"https://support.microsoft.com/en-us/topic/kb5025885-how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023-24932-41a975df-beb2-40c1-99a3-b3ff139f832d","date":"2024-04-09"},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24932","date":"2025-02-11"},{"url":"https://media.defense.gov/2025/Dec/11/2003841096/-1/-1/0/CSI_UEFI_SECURE_BOOT.PDF","date":"2025-12-11"}],"evidenceTotal":7,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24932","tags":["vendor-advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-28920","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-28920","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":4,"skipped":0,"earliest":"2025-02-07","earliestUrl":"https://github.com/helleflo1312/Orchestrated-Powershell-for-CVE-2023-24932","repos":[{"name":"ajf8729/BlackLotus","url":"https://github.com/ajf8729/BlackLotus","stars":8,"created":"2025-05-11"},{"name":"helleflo1312/Orchestrated-Powershell-for-CVE-2023-24932","url":"https://github.com/helleflo1312/Orchestrated-Powershell-for-CVE-2023-24932","stars":1,"created":"2025-02-07"},{"name":"v1ckxy/Orchestrated-Powershell-for-CVE-2023-24932-en","url":"https://github.com/v1ckxy/Orchestrated-Powershell-for-CVE-2023-24932-en","stars":0,"created":"2025-12-23"},{"name":"ETS-MSE/secure-boot-cert-servicing","url":"https://github.com/ETS-MSE/secure-boot-cert-servicing","stars":0,"created":"2026-07-27"}]},"first":{"date":"2025-02-07","source":"PoC-in-GitHub","url":"https://github.com/helleflo1312/Orchestrated-Powershell-for-CVE-2023-24932"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-05-09","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-24932","provenance":"source"},{"date":"2023-05-09","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://msrc.microsoft.com/blog/2023/05/guidance-related-to-secure-boot-manager-changes-associated-with-cve-2023-24932/","provenance":"source"},{"date":"2025-02-07","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/helleflo1312/Orchestrated-Powershell-for-CVE-2023-24932","provenance":"source"}],"speed":{"daysToPublicExploit":640,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":63.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1272 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.22,"detail":"percentile 0.9609"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"4 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":4.69,"detail":"base score 6.7"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-windows-cwe-863"}}