How BlackLotus UEFI Bootkit Bypasses Secure Boot and Microsoft’s Patch Roadmap

Background

BlackLotus is a UEFI‑level bootkit (CVE‑2023‑24932) that executes before the operating system loads. It bypasses Windows Secure Boot by using a signed payload that exploits the trust chain of older boot manager certificates.

Microsoft Patch Timeline

Microsoft mitigated the threat with a phased rollout of updates starting in May 2023. The rollout was expanded to five phases:

Phase 1 (2023‑05‑09): KB5025885 released; BlackLotus and legacy boot managers added to the DBX blacklist. Activation required manual command.

Phase 2 (2023‑07‑11): Added WinRE support and simplified the activation command.

Phase 3 (after 2024‑04‑09): Revoked the “Windows Production PCA 2011” certificate and switched to the new “Windows UEFI CA 2023” for signing boot managers.

Phase 4 (after 2024‑07‑09): Encouraged proactive deployment of mitigations and warned about the upcoming expiration of the old certificate.

Phase 5: Enforced the new signing requirements, rendering boot managers signed with the old certificate unusable.

These updates also required refreshing UEFI firmware and blacklisting older Windows boot managers, causing ISO images, USB boot tools, and WinPE environments created before 2023‑05‑09 to fail to boot.

Certificate Expiration and UI Indicators

The original Secure Boot certificates were issued in 2011 with a 15‑year validity, expiring in 2026. After expiration, any boot component signed with the old PCA‑2011 certificate (e.g., bootmgfw.efi) will be rejected, preventing the system from starting.

Microsoft added a status indicator in the Windows Security app to show whether the 2023 certificate has been applied. The UI uses three colors:

🟢 Green check: Secure Boot is functional, but deeper issues may still exist.

🟡 Yellow warning: Secure Boot is active, but the new CA‑2023 certificate is not yet in use.

🔴 Red X: The device cannot receive the required updates, risking boot failure.

System‑level notifications are planned for May 2026 to remind users to install the updated certificates.

User Recommendations

For typical Windows users who do not wish to modify UEFI settings, the simplest guidance is to keep automatic Windows updates enabled; Microsoft will apply the necessary firmware and certificate updates automatically.

Official reference: Secure Boot Certificate Update Status – Microsoft Support (https://support.microsoft.com/en-us/topic/secure-boot-certificate-update-status-in-the-windows-security-app-5ce39986-7dd2-4852-8c21-ef30dd04f046)