Microsoft Details Secure Boot Certificate Revocations to Block BlackLotus Rollback Attacks
Active Exploitation · 2 sources · Updated 9d ago · First seen Apr 8, 2026
Microsoft has documented a staged Secure Boot hardening process to mitigate CVE-2023-24932, a bypass associated with the BlackLotus UEFI bootkit that requires administrative privileges or physical access to exploit. BlackLotus exploits CVE-2022-21894, known as Baton Drop, using vulnerable Windows boot managers; Microsoft subsequently identified bypasses of protections introduced in May 2023. The expanded mitigations establish trust in Windows UEFI CA 2023, install updated Windows Boot Managers, revoke the older Microsoft Windows Production PCA 2011 certificate through the Secure Boot Forbidden Signature Database (DBX), and introduce firmware-backed rollback protection.
According to Microsoft’s updated KB5025885 guidance, Windows security updates released July 9, 2024, and later include these protections, but they are not enabled by default, and mandatory enforcement remains unannounced. Administrators must deploy the new trust anchor and updated boot managers before applying revocations; incorrect sequencing can leave systems, recovery media, and network boot environments unable to boot. Microsoft recommends testing representative devices, updating recovery and installation media, checking firmware compatibility and platform-specific deployment blockers, and preparing for boot failures and BitLocker recovery before broad rollout.
