# UEFI bootkit infected fully patched Windows machines. Is Microsoft to blame?

- URL: https://talkfuse.com/story/uefi-bootkit-infected-fully-patched-windows-machines-is-microsoft-to-blame/
- Published: 2026-11-03T16:03:13+00:00
- Updated: 2026-11-03T17:31:08+00:00
- Original publisher: Ars Technica
- Original article: https://arstechnica.com/security/2026/11/uefi-bootkit-infected-fully-patched-windows-machines-is-microsoft-to-blame/
- Topics: Business, Markets

## Key points

- BlackX bypassed Secure Boot on patched Windows machines.
- It exploits a flaw in older Windows boot managers.
- The infections raise questions about Microsoft’s mitigation updates.

## Summary

BlackX, a UEFI bootkit that can bypass Secure Boot on fully patched Windows machines, has infected organisations despite Microsoft’s updates intended to block this attack. The infections raise questions about whether Microsoft’s protections are clear and complete, because the malware can run before many Windows security defences start.

BlackX exploits the Baton Drop flaw, CVE-2022-21894, in older Windows boot managers, as did the earlier BlackLotus bootkit. Microsoft fixed the flaw in 2022, then issued updates in 2023 and 2024 to add a newer signing certificate and enable revocation of trust in the older one. The article says the infected organisations had installed these patches; the supplied text ends before explaining how BlackX bypassed them.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.