Windows Secure Boot Security Feature Bypass (Baton Drop)
A Secure Boot bypass in Windows allows attackers to load unsigned bootloaders via legacy certificates. Exploited by APT41's BlackX UEFI bootkit in 2026 against diplomatic targets.
- Vendor
- Microsoft
- Product
- Windows 10, Windows 11, Windows Server 2012/2016/2019/2022
- CVSS
- 4.4
- EPSS (exploit probability)
- 6.8%
- Status
- exploited-in-wild
- Published
Is CVE-2022-21894 being exploited?
Exploitation has been reported (sources in the write-up below), but CVE-2022-21894 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-25 snapshot.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 6.8% (scored October 24, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-25. Full cross-catalog view: /kev-comparison
CVE-2022-21894 timeline
- Published to NVD
- Patch availablesame day as NVDPatch available but revocation certificates must be explicitly deployed
- Vendor advisorysame day as NVDMicrosoft January 2022 Patch Tuesday; certificate revocations require manual activation separate from patching
- Exploitation reported+1747dKaspersky and ESET report BlackX UEFI bootkit exploiting Baton Drop in APT41 espionage campaign
- First 0dayNews coverage+1748d
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
CVE-2022-21894, known as “Baton Drop,” is a Secure Boot bypass in Windows that allows an attacker with physical or privileged access to load a custom bootloader, bypassing Secure Boot validation by exploiting the trust chain for legacy signed certificates.
Microsoft patched this in January 2022, but the fix involves two separate steps: the patch itself, and the explicit activation of certificate revocations that block the vulnerable bootloaders. The revocations are not applied automatically by Windows Update, which has left a persistent gap on systems where admins applied the patch but never activated the revocations.
Active exploitation in 2026: Kaspersky and ESET researchers disclosed that APT41 (Brass Typhoon/Wicked Panda/Barium) used the BlackX UEFI bootkit to exploit this vulnerability in an early-2026 espionage campaign targeting diplomatic agencies in Tajikistan, Uzbekistan, and Turkmenistan. The vulnerable certificates were due to expire October 19, 2026. Systems missing the manual revocation step remained exploitable until that date, even if fully current on Windows patches.
Mitigation: Apply Microsoft’s Secure Boot revocations explicitly. Verify revocation status per system rather than relying on patch compliance reports. Audit EFI partitions for unexpected Machine Owner Key (MOK) enrollments or unfamiliar EFI binaries.
Other Microsoft CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-96951 Microsoft Windows Command Injection Vulnerability | [ HIGH ] | 8.8 | 1.5% | |
| CVE-2026-96940 Microsoft Exchange Server privilege escalation via weak authorizationwrite-up | [ HIGH ] | 8.8 | 0.5% | — |
| CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerabilitywrite-up | [ HIGH ] | 8.8 | 2.1% | |
| CVE-2026-85889 Azure AI Foundry missing authentication allows unauthorized privilege escalationwrite-up | [ CRITICAL ] | 10.0 | 0.7% | — |
| CVE-2026-69843 Microsoft Fabric authentication bypass by spoofingwrite-up | [ CRITICAL ] | 10.0 | 0.9% | — |
| CVE-2026-85880 Microsoft Windows ALPC Heap Buffer Overflow Privilege Escalationwrite-up | [ HIGH ] | 7.8 | 3.6% | |
| CVE-2026-81963 Microsoft Windows Update Stack Link-Following Privilege Escalationwrite-up | [ HIGH ] | 7.8 | 0.4% | |
| CVE-2026-62916 Authentication Bypass via Alternate Path in Microsoft Entra IDwrite-up | [ CRITICAL ] | 9.1 | 0.9% | — |
