Loading vulnerability…
Rejected CVE-2019-14560 EDK II Secure Boot State Check
CVE-2019-14560 is a rejected candidate number that was not assigned to an issue. Contextual technical material associates the identifier with EDK II logic that did not check the return value of GetEfiGlobalVariable2() when determining whether Secure Boot was enabled; however, this association does not establish a valid CVE record.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
No CVE-specific impact is established because CVE-2019-14560 was rejected and was not assigned to an issue. The contextual EDK II claim does not document a confirmed exploitation outcome.
Patch, then assume compromise.
For CIQ LTS 8.6 systems covered by CIQ advisory ciqsa-2026_0037, update the applicable edk2 packages in accordance with that advisory. This is a package-advisory remediation and does not validate CVE-2019-14560 as an assigned vulnerability.
No public exploits tracked yet. Mallory keeps watching.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.