Trusted UEFI Certificates Exploited to Bypass Kernel Security Protections

A critical UEFI firmware vulnerability discovered by ESET’s Martin Smolar allows attackers to weaponize vendor-signed UEFI applications (e.g., shells, GRUB2) to bypass Secure Boot, run arbitrary code in the pre-boot stage, and achieve persistent, EDR‑evading compromises across systems from numerous major vendors; the report lists affected binaries and hashes and advises applying vendor firmware updates, updating DBX/DB revocations, verifying DBX integrity, and restricting access.