CVE-2026-21265

Windows Secure Boot stores Microsoft certificates in the UEFI KEK and DB. These original certificates are approaching expiration, and devices containing affected certificate versions must update them to maintain Secure Boot functionality and avoid compromising security by losing security fixes related to Windows boot manager or Secure Boot. The operating system’s certificate update protection mechanism relies on firmware components that might contain defects, which can cause certificate trust updates to fail or behave unpredictably. This leads to potential disruption of the Secure Boot trust chain and requires careful validation and deployment to restore intended security guarantees. Certificate Authority (CA) Location Purpose Expiration Date Microsoft Corporation KEK CA 2011 KEK Signs updates to the DB and DBX 06/24/2026 Microsoft Corporation UEFI CA 2011 DB Signs 3rd party boot loaders, Option ROMs, etc. 06/27/2026 Microsoft Windows Production PCA 2011 DB Signs the Windows Boot Manager 10/19/2026 For more information see this CVE and Windows Secure Boot certificate expiration and CA updates.

• CWE-1329

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21265Vendor Advisory

Published

Jan 13, 2026

Last Modified

Jul 30, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-21259Heap-based buffer overflow in Microsoft Office Excel allows …7.8
• CVE-2026-2126The User Submitted Posts – Enable Users to Submit Posts from…5.3
• CVE-2026-21260Exposure of sensitive information to an unauthorized actor i…7.5
• CVE-2026-21261Out-of-bounds read in Microsoft Office Excel allows an unaut…5.5
• CVE-2026-21262Improper access control in SQL Server allows an authorized a…8.8
• CVE-2026-21264Improper neutralization of input during web page generation …6.1
• CVE-2026-21267Dreamweaver Desktop versions 21.6 and earlier are affected b…8.6
• CVE-2026-21268Dreamweaver Desktop versions 21.6 and earlier are affected b…8.6
• CVE-2026-21269is affected by a stored Cross-Site Scripting (XSS) vulnerabi…4.6
• CVE-2026-2127The SiteOrigin Widgets Bundle plugin for WordPress is vulner…5.4
• CVE-2026-21271Dreamweaver Desktop versions 21.6 and earlier are affected b…8.6
• CVE-2026-21272Dreamweaver Desktop versions 21.6 and earlier are affected b…8.6