# BlackX UEFI Bootkit Exploits Secure Boot Flaw on Patched Windows Systems

*Published November 4, 2026*
*Source: [https://arstechnica.com/security/2026/11/uefi-bootkit-infected-fully-patched-windows-machines-is-microsoft-to-blame/](https://arstechnica.com/security/2026/11/uefi-bootkit-infected-fully-patched-windows-machines-is-microsoft-to-blame/)*

## Executive Summary

The BlackX UEFI bootkit exploited a vulnerability in Secure Boot on patched Windows systems, due to incomplete revocation of older certificates. Despite Microsoft's updates, many organizations remained vulnerable because the necessary steps to activate protection were not clearly communicated.

## Article

In 2023, the BlackLotus malware became the first known UEFI bootkit to bypass Secure Boot on fully updated Windows 11 systems. This type of malware runs malicious code before Windows loads, subverting industry-wide chain-of-trust mechanisms. Despite Microsoft providing patches in 2022, 2023, and 2024, organizations still fell victim to a new variant known as BlackX. These patches aimed to address a logic flaw in the Windows boot manager, tracked as CVE-2022-21894, which allowed attackers to bypass Secure Boot. Microsoft initially fixed the flaw by introducing a new signing certificate and later provided updates to revoke trust in older vulnerable certificates. However, the updates did not automatically revoke trust in these older boot managers, leaving a gap that BlackX exploited. 

The challenge with UEFI bootkits like BlackLotus and BlackX is their ability to execute early in the boot process, loading malicious drivers before many security defenses activate. These bootkits are stealthy, persistent, and can remain undetected without specialized tools. They are also difficult to eliminate, as they may survive OS reinstallations if the infected boot partition is not addressed. 

Microsoft's mitigation efforts included adding a new signing certificate, Windows UEFI CA 2023, and later efforts to block older boot managers signed with the Windows Production PCA 2011 certificate. However, concerns about rendering devices unbootable prevented Microsoft from enforcing these revocations immediately. This situation allowed BlackX to bypass Secure Boot three years after BlackLotus. 

The incident highlights the complexity of balancing security updates with potential disruption to users. Microsoft advises administrators to follow specific instructions in a Knowledge Base post to activate the patches fully, but these instructions are not prominently communicated. This lack of awareness led to few organizations taking the necessary steps, leaving systems vulnerable to exploitation.