CVSS Score v3.1
6.7
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.0026
49.6th percentile
Risk Priority
14
60% EPSS · 20% KEV · 20% CVSS
Summary
CVE-2026-41097 is a medium-severity Reliance on Component That is Not Updateable (CWE-1329) vulnerability in Microsoft Windows 10 21H2 . Its CVSS base score is 6.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique System Firmware (T1542.001); ranked at the 49.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Vulnerability
Related Threats
Affected Assets
Mitigating Controls
Vulnerability details
Reliance on a component that is not updateable in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.
CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
T1542.001 System Firmware Stealth
Adversaries may modify system firmware to persist on systems.
T1542.003 Bootkit Stealth
Adversaries may use bootkits to persist on systems.
Why these techniques? Bypassing Windows Secure Boot directly enables pre-OS boot attacks via system firmware modification or bootkit installation.
Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1
Affected Assets
microsoft
windows 10 1809
≤ 10.0.17763.8755 · ≤ 10.0.17763.8755
microsoft
windows 10 21h2
≤ 10.0.19044.7291 · ≤ 10.0.19044.7291 · ≤ 10.0.19044.7291
microsoft
windows 10 22h2
≤ 10.0.19045.7291 · ≤ 10.0.19045.7291 · ≤ 10.0.19045.7291
microsoft
windows 11 23h2
≤ 10.0.22631.7079 · ≤ 10.0.22631.7079
microsoft
windows 11 24h2
≤ 10.0.26100.8390 · ≤ 10.0.26100.8390
microsoft
windows 11 25h2
≤ 10.0.26200.8390 · ≤ 10.0.26200.8390
microsoft
windows 11 26h1
≤ 10.0.28000.2113 · ≤ 10.0.28000.2113
microsoft
windows server 2019
≤ 10.0.17763.8755
microsoft
windows server 2022
≤ 10.0.20348.5074
microsoft
windows server 2022 23h2
≤ 10.0.25398.2330
+1 more product configuration(s) — see NVD for full list
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.