CVE-2022-21894

Secure Boot is like a tamper-proof seal that checks a computer hasn't been secretly altered before it starts up. This flaw lets someone who already has high-level access to a device break that seal and plant hidden, hard-to-remove malware that survives reboots and reinstalls. It's been used by a known APT41 hacking group as part of a bootkit (BlackLotus) in attacks against diplomatic organizations.

This matters if you run Windows 10, Windows 11, Windows 8.1, or any of the listed Windows Server versions (2012, 2012 R2, 2016, 2019, 2022) on devices you manage. It's only exploitable by someone who already has high-level (administrator-level) access to the machine — it is not something a random internet attacker can trigger remotely without that foothold first.

Attackers are already exploiting this in real-world campaigns — a BlackLotus bootkit variant tied to the APT41 group has been used against diplomatic targets, confirming active abuse rather than theoretical risk. Treat this as urgent: apply the fix now rather than waiting, especially if your organization could be a target for espionage or has high-value data.

Confirm exposure by checking installed Windows build numbers across all endpoints and servers against the fixed builds listed per product line (e.g., Windows 10/Server 2019 → 10.0.17763.2452, Windows 10 1909 → 10.0.18363.2037, Windows 10 2004/20H2 → 10.0.19042.1466, Windows 10 21H1 → 10.0.19043.1466, Windows 10 21H2 → 10.0.19044.1466, Windows 10 LTSB → 10.0.10240.19177, Windows 10 1607/Server 2016 → 10.0.14393.4886, Windows 11 → 10.0.22000.434, Windows Server 2022 → 10.0.20348.469). Deploy the corresponding cumulative security update via WSUS/Intune/SCCM and reboot; note that revoking vulnerable boot components may require additional steps (DBX/SKU Siphon updates) beyond the OS patch itself, so follow Microsoft's full Secure Boot revocation guidance, not just the cumulative update. There is no practical workaround short of patching since the flaw targets the boot integrity chain itself; restricting local admin/high-privilege access reduces but does not eliminate risk. Not currently listed in CISA KEV, so there is no mandated federal remediation deadline, but monitor for Microsoft's phased Secure Boot DBX revocation rollout, which can affect dual-boot and older bootloader configurations — test before broad deployment. Watch for unusual boot-time behavior, unsigned bootloader components, or EDR alerts related to BlackLotus indicators.

CVSS 3.1 score 4.4 (Medium), vector AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N — local attack vector, low complexity, high privileges required, no user interaction, integrity impact only. Weakness: CWE-863 (Incorrect Authorization). Not in CISA KEV, but news reporting confirms real-world exploitation by APT41 via a BlackLotus bootkit variant against diplomatic targets, which supersedes the EPSS-predicted likelihood for urgency purposes. No public exploit code is on record; exploitation has been observed only through APT tradecraft, not commodity tooling. EPSS trend is falling, consistent with this being an older (2022), low-prevalence, targeted-use vulnerability rather than mass-exploited.