Loading story…
Microsoft's rollout of the Windows 11 Secure Boot 2023 certificate update continues to cause operational problems across enterprise and deployment environments, with administrators reporting BitLocker recovery loops, KEK update failures, and incorrect Secure Boot status on older PCs. Reports from Microsoft's OEM discussions indicate the issues affect multiple vendors rather than a single manufacturer, with HP fleets including EliteBook and ZBook systems repeatedly entering recovery and some Dell devices also impacted even after BIOS updates and documented remediation steps. Microsoft has reportedly paused deployment on certain firmware and device combinations because of known compatibility problems.
The same rollout is also being linked to broader boot and update disruptions. Some Windows 11 systems now require multiple reboots during major monthly updates because Secure Boot certificate installation is being staged alongside other components such as .NET updates, and Microsoft has not yet completed deployment despite earlier expectations. Separately, administrators have reported Winload.efi errors during PXE and USB-based boot scenarios across Lenovo hardware, including cases using updated SCCM images and Microsoft's ADK, suggesting the certificate transition may also be affecting imaging and recovery workflows; some devices are additionally logging SCEP enrollment errors tied to TPM attestation requests, though those messages are generally considered non-critical.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
A sysadmin Reddit post described Winload.efi errors when PXE booting Windows machines and when booting from a USB containing only Microsoft's ADK, across multiple Lenovo models. The poster said the issue persisted despite updated firmware and BIOS, SCCM 2603 with new certificates in the WIM, and regardless of whether UEFICA2023STATUS was set to Updated.
WindowsLatest reported that some Windows 11 systems installing large monthly updates such as the July 2026 Patch Tuesday release may reboot twice instead of once. The article attributed the behavior mainly to separate .NET Framework installation steps and Microsoft's ongoing Secure Boot 2023 certificate rollout, including KB5101650.
During Microsoft's July 15 OEM Secure Boot Office Hours event, IT administrators reported persistent problems tied to the Windows 11 Secure Boot 2023 certificate rollout, including BitLocker recovery loops, KEK update failures, and incorrect Secure Boot status reporting across enterprise fleets. Several HP and Dell cases remained unexplained by the end of the session, and Microsoft indicated rollout had been paused on some device and firmware combinations due to known firmware issues.
Microsoft published guidance stating that legacy Microsoft Secure Boot certificates used in the UEFI trust chain would begin expiring in June 2026 and that organizations needed to update to 2023-era certificates. The post warned that unprepared devices and VMs could lose Secure Boot updateability and miss future boot security protections, and it provided rollout recommendations including OEM firmware updates and an opt-in registry key for managed updates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcewindowslatest.com
Open sourcereddit.com
Open sourcewindowslatest.com
Open sourcetechcommunity.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released the June cumulative update `KB5093998` for Windows 11 23H2 with security fixes, broader Secure Boot certificate rollout support, and a new Group Policy/MDM option to limit Secure Boot service data sent to Microsoft. The update also fixes a known issue that could force some devices into **BitLocker Recovery** after boot file updates, while CERT/CC and Microsoft separately published advisories on a Secure Boot bypass affecting Microsoft-signed UEFI shim bootloaders, tracked as `CVE-2026-44815`. At the same time, Microsoft warned that some PCs upgraded from Windows 10 21H2/22H2 or Windows 11 23H2 to Windows 11 24H2 or 25H2 may fail to install the June 2026 cumulative updates, showing errors `0x80073712` or `0x800f0993` because of package and component store issues. Microsoft said an automatic fix is rolling out for unmanaged enterprise and Home devices after restart, while already affected systems may require removing a problematic package with DISM or performing an in-place upgrade; separate reporting also said recent HP BIOS updates and Dell SupportAssist software caused BitLocker loops and BSODs that were initially blamed on Windows but traced to OEM firmware and utilities.
Jun 29, 2026
Microsoft’s Windows 11 cumulative update `KB5094126` is causing serious post-installation failures on some systems after its release with roughly 200 security fixes, including 33 critical flaws and five zero-days. Users reported freezes shortly after boot, black screens, boot loops, BSODs, and repeated BitLocker recovery prompts, including on devices where BitLocker was believed to be disabled. Reports indicate the problems are hitting some HP models particularly hard, with Secure Boot certificate changes and interactions with BIOS/UEFI settings and undersized or crowded EFI partitions emerging as likely factors. The update is also disrupting enterprise and productivity workflows by breaking File Explorer integration for OneDrive and, in some cases, Dropbox and iCloud Drive, while some affected machines reportedly lose LAN access even though internet connectivity remains available. Administrators and users have resorted to Windows Recovery Environment to remove the patch, and some systems reportedly required full Windows reinstalls after recovery complications. A widely shared workaround has been to temporarily disable Secure Boot, complete boot and update recovery, then re-enable Secure Boot after updating BIOS/UEFI firmware, though Microsoft had not formally acknowledged the full scope of the issues in the update documentation at the time of reporting.
Jun 29, 2026
Microsoft warned that Secure Boot certificates issued in 2011 are nearing expiration and that devices which do not receive the newer 2023 Secure Boot update will generally keep booting, but may stop receiving future boot-chain protections. The gap affects some older Windows systems whose OEMs no longer provide compatible BIOS or UEFI updates, as well as devices running Legacy BIOS, CSM mode, or unsupported Windows 11 configurations with Secure Boot disabled. Microsoft is reportedly skipping incompatible hardware rather than forcing updates that could cause failures, but enterprises may still face compliance, cyber-insurance, and lifecycle-management pressure because those endpoints could miss future `DBX` revocations, Windows Boot Manager updates, and mitigations for bootloader threats such as **BlackLotus**. The transition is also creating planning challenges beyond Windows. Linux distributions that rely on Microsoft-signed **shim** loaders are expected to continue booting on systems that already trust the older Microsoft UEFI CA, but older PCs that never receive firmware updates with the 2023 certificates may have trouble booting newer Linux media or releases. The issue follows Microsoft's broader effort to harden the pre-boot environment after flaws such as `CVE-2024-21302`, a Windows Secure Kernel Mode elevation-of-privilege bug that could let an administrator roll back VBS-related files to bypass protections; Microsoft responded with boot-time code integrity policies, an optional `SkuSiPolicy.p7b` revocation policy, and stronger protections on newer Windows releases. Administrators are being urged to verify Secure Boot update status, update firmware and recovery media where possible, and document compensating controls or replace hardware that cannot be brought forward.
Jun 29, 2026