Summary
Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
What action do customers need to take to address this vulnerability?
After Microsoft deploys the platform update, customers must restart their affected Azure Trusted Launch or confidential virtual machines to apply the updated Secure Boot protection. Plan the restart for an appropriate maintenance window to minimize disruption to workloads. For information about these VM security features, see Trusted Launch and Azure confidential VMs.
What kind of security feature could be bypassed by successfully exploiting this vulnerability?
An attacker who successfully exploited this vulnerability could bypass Secure Boot.
Vulnerabilities 1
-
Medium 4.4
Azure Firmware Security Feature Bypass Vulnerability
Improper check for certificate revocation in Azure Firmware allows an authorized attacker to bypass a security feature locally.
Revision history
-
#1
Information published.
References
-
CVE-2026-109462 Azure Firmware Security Feature Bypass Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109462
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss