OVERSEER NOTE: June 2026 is witnessing one of the most operationally disruptive certificate rotations in Microsoft history. With the deployment of the June Cumulative Update (KB5094126 / KB5094125), Microsoft has pushed the wide-scale enforcement of the Secure Boot 2023 certificate rotation [cite: 1.1.1].
The result is a direct collision between decade-old UEFI hardware trust anchors, modern virtualization hypervisors, and Windows boot managers, throwing thousands of systems into immediate, unbootable states [cite: 1.1.1, 1.3.3].
Incident 1: VMware ESXi 8.0 Guest VM Lockouts
The Fracture: Virtual machines running on VMware ESXi with virtual Trusted Platform Modules (vTPM) enabled and Secure Boot active are completely failing to boot after applying the June update [cite: 1.3.3].
The Root Cause: When the guest Windows OS attempts to commit the new Microsoft Secure Boot keys, the underlying hypervisor layer fails to translate the write operation correctly. Instead of committing the new 2023 key, the hypervisor writes a NULL value to the Platform Key (PK) structure, destroying the Secure Boot trust chain entirely [cite: 1.3.3].
The Remediation: Broadcom has acknowledged the critical issue and shipped an emergency patch.
- Deploy VMware ESXi 8.0 U3j immediately to all affected hosts [cite: 1.3.3].
- For unpatched hosts, the temporary workaround is to edit the virtual machine settings:
- Power down the guest.
- Edit Settings > VM Options > Boot Options.
- Temporarily Uncheck “Secure Boot Enabled”.
- Boot the VM, apply updates, then re-enable after ESXi has been patched.
Incident 2: Dell & HP BitLocker Recovery Storms
The Fracture: Enterprise laptops and desktops from Dell (especially Latitude/Precision) and HP (EliteBook) are bypassing the normal boot sequence and booting directly into the blue BitLocker Recovery screen on the first reboot post-patch [cite: 1.3.3].
The Root Cause: The firmware on these specific devices fails validation checks when the boot manager transitions to the newly staged cryptographic revocation list (DBX) [cite: 1.1.1, 1.3.3]. Because the PCR registers change value during this update, BitLocker detects a potential tampering attempt and locks down the system drive [cite: 1.3.3].
The Preventative Remediation (Before Patching): If you have not pushed KB5094126 to your endpoints yet, you must suspend BitLocker protectors temporarily [cite: 1.3.3]:
Suspend-BitLocker -MountPoint "C:" -RebootCount 1
The Emergency Recovery (Post-Patch Lockout): If the device is already locked, you have no choice but to retrieve the recovery key from Active Directory, Azure AD, or your escrow system [cite: 1.3.3].
Once booted back into Windows, force a policy refresh using PowerShell to clean up the pending UEFI key staging:
Confirm-SecureBootUEFI
VIGILANCE NOTE: Do not simply turn off Secure Boot permanently to resolve these loops. Doing so strips your OS of modern credential guard protections and opens the kernel to local privilege escalation attacks (like GreenPlasma and YellowKey). Patch your hypervisors and firmware instead [cite: 1.2.3].