CVE-2026-25250: MITRE: CVE-2026-25250 Secure Boot disable Eazy Fix

CVE-2026-25250 is a security feature bypass vulnerability in MITRE, rated Important by Microsoft, with a CVSS 3.1 base score of 6 (Medium). An attacker can exploit it by an attacker with local access, with high privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.12% probability of exploitation activity in the next 30 days, higher than 2% of all scored vulnerabilities. Microsoft released the fix on 14 April 2026 in the April 2026 Patch Tuesday, delivered through 11 security updates (KB5083768, KB5082123, KB5082142, KB5082200 and more). It affects 31 products in 2 product families (Windows, ESU).

Key facts

CVE ID

CVE-2026-25250

Severity

Medium CVSS 6

Microsoft severity

Important

Impact

Security Feature Bypass

Exploited in the wild

No

Publicly disclosed

No

Exploitation likelihood

Less Likely

Weakness

CWE-325

EPSS

0.12% (percentile 2%)

CISA KEV

Not listed

Released

14 April 2026

Last updated

14 April 2026

Patch Tuesday

April 2026 Patch Tuesday

Product families

Windows, ESU

CVSS score and vector

Microsoft scores CVE-2026-25250 at 6 (temporal 5.2) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C

Description

Missing cryptographic step in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

Frequently asked questions (Microsoft)

What kind of security feature could be bypassed by successfully exploiting this vulnerability?

An attacker who successfully exploited this vulnerability could bypass Secure Boot.

Why is this vulnerability being published under a MITRE CVE rather than a Microsoft‑assigned CVE?

The vulnerability exists in third‑party firmware rather than Microsoft‑developed code. Although Windows is affected, the CVE is issued by MITRE in accordance with standard disclosure practices while Microsoft provides mitigations to help protect customers.

Affected products (31)

Windows

ESU

Security updates (11)

• KB5083768 (Security Update)
• KB5082123 (Security Update)
• KB5082142 (Security Update)
• KB5082200 (Security Update)
• KB5082063 (Security Update)
• KB5083769 (Security Update)
• KB5082052 (Security Update)
• KB5082060 (Security Update)
• KB5082198 (Security Update)
• KB5082127 (Monthly Rollup)
• KB5082126 (Monthly Rollup)

Exploitation and detection

Detection and weaponization

Weaponization maturity: Exploit.

Proof-of-concept repositories (1)

• TheMalwareGuardian/CVE-2026-25250 · 1 stars

NIST NVD data

NVD status

Deferred

NVD CVSS

6 (MEDIUM)

NVD weakness

CWE-325

Published to NVD

27 August 2026

NVD last modified

9 September 2026

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25250
• https://www.eazsolution.com/eazyfix.html

Acknowledgments

• Léo Muff
• Stas Lyakhov with Eclypsium
• Mickey Shkatov with Eclypsium
• Stas Lyakhov with Eclypsium

Revision history

Related vulnerabilities

Other MITRE vulnerabilities

• CVE-2026-6726: MITRE: CVE-2026-6726 TPM 2.0 Improper Object Slot Reuse (High, CVSS 7.9, August 2026)
• CVE-2026-6727: MITRE: CVE-2026-6727 TPM 2.0 RSA OAEP Timing Side-Channel Vulnerability (Medium, CVSS 5.9, August 2026)
• CVE-2023-31096: MITRE: CVE-2023-31096 Windows Agere Soft Modem Driver Elevation of Privilege Vulnerability (High, CVSS 7.8, January 2026)
• CVE-2025-59489: MITRE: CVE-2025-59489 Unity Gaming Engine Editor vulnerability (High, CVSS 8.4, October 2025)
• CVE-2023-50868: MITRE: CVE-2023-50868 NSEC3 closest encloser proof can exhaust CPU (High, CVSS 7.5, June 2024)
• CVE-2023-50387: MITRE: CVE-2023-50387 DNSSEC verification complexity can be exploited to exhaust CPU resources and stall DNS resolvers (N/A, February 2024)
• CVE-2022-35737: MITRE: CVE-2022-35737 SQLite allows an array-bounds overflow (N/A, January 2024)
• CVE-2023-24023: Mitre: CVE-2023-24023 Bluetooth Vulnerability (N/A, November 2023)
• CVE-2023-44487: MITRE: CVE-2023-44487 HTTP/2 Rapid Reset Attack (N/A, exploited, October 2023)
• CVE-2021-45985: Mitre: CVE-2021-45985 Erroneous finalizer call in Lua leads to a heap-based buffer over-read (Medium, CVSS 5.5, April 2023)
• CVE-2019-15126: MITRE: CVE-2019-15126 Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device (N/A, February 2023)

More from the April 2026 Patch Tuesday

• CVE-2026-32202: Windows Shell Spoofing Vulnerability (Medium, CVSS 4.3, exploited)
• CVE-2026-33824: Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability (Critical, CVSS 9.8)
• CVE-2026-32225: Windows Shell Security Feature Bypass Vulnerability (High, CVSS 8.8)
• CVE-2026-32162: Windows COM Elevation of Privilege Vulnerability (High, CVSS 8.4)
• CVE-2026-33826: Windows Active Directory Remote Code Execution Vulnerability (High, CVSS 8)
• CVE-2026-27909: Windows Search Service Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-27914: Microsoft Management Console Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-32152: Desktop Window Manager Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-32154: Desktop Window Manager Elevation of Privilege Vulnerability (High, CVSS 7.8)
• CVE-2026-27913: Windows BitLocker Security Feature Bypass Vulnerability (High, CVSS 7.7)
• CVE-2026-26151: Remote Desktop Spoofing Vulnerability (High, CVSS 7.1)
• CVE-2026-27908: Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability (High, CVSS 7)

All vulnerabilities of this release: April 2026 Patch Tuesday · April 2026 briefing

Sources

• Microsoft Security Update Guide: CVE-2026-25250
• NIST NVD: CVE-2026-25250
• CVE.org record: CVE-2026-25250