{"id":51,"date":"2026-06-15T20:24:33","date_gmt":"2026-06-15T20:24:33","guid":{"rendered":"https:\/\/patchtuesdayfallout.com\/archives\/?p=51"},"modified":"2026-06-15T20:24:35","modified_gmt":"2026-06-15T20:24:35","slug":"intel-entry-006-the-secure-boot-rotation-crisis-kb5094126","status":"publish","type":"post","link":"https:\/\/patchtuesdayfallout.com\/archives\/2026\/06\/15\/intel-entry-006-the-secure-boot-rotation-crisis-kb5094126\/","title":{"rendered":"INTEL ENTRY 006: THE SECURE BOOT ROTATION CRISIS (KB5094126)"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>OVERSEER NOTE:<\/strong> June 2026 is witnessing one of the most operationally disruptive certificate rotations in Microsoft history. With the deployment of the June Cumulative Update (<strong>KB5094126<\/strong> \/ <strong>KB5094125<\/strong>), Microsoft has pushed the wide-scale enforcement of the Secure Boot 2023 certificate rotation [cite: 1.1.1].<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The result is a direct collision between decade-old UEFI hardware trust anchors, modern virtualization hypervisors, and Windows boot managers, throwing thousands of systems into immediate, unbootable states [cite: 1.1.1, 1.3.3].<\/p>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>Incident 1: VMware ESXi 8.0 Guest VM Lockouts<\/strong><\/h4>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The Fracture:<\/strong> Virtual machines running on VMware ESXi with virtual Trusted Platform Modules (vTPM) enabled and Secure Boot active are completely failing to boot after applying the June update [cite: 1.3.3].<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The Root Cause:<\/strong> When the guest Windows OS attempts to commit the new Microsoft Secure Boot keys, the underlying hypervisor layer fails to translate the write operation correctly. Instead of committing the new 2023 key, the hypervisor writes a <code>NULL<\/code> value to the Platform Key (PK) structure, destroying the Secure Boot trust chain entirely [cite: 1.3.3].<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The Remediation:<\/strong> Broadcom has acknowledged the critical issue and shipped an emergency patch.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Deploy <strong>VMware ESXi 8.0 U3j<\/strong> immediately to all affected hosts [cite: 1.3.3].<\/li>\n\n\n\n<li>For unpatched hosts, the temporary workaround is to edit the virtual machine settings:\n<ul class=\"wp-block-list\">\n<li>Power down the guest.<\/li>\n\n\n\n<li>Edit Settings > <strong>VM Options<\/strong> > <strong>Boot Options<\/strong>.<\/li>\n\n\n\n<li>Temporarily <strong>Uncheck &#8220;Secure Boot Enabled&#8221;<\/strong>.<\/li>\n\n\n\n<li>Boot the VM, apply updates, then re-enable after ESXi has been patched.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>Incident 2: Dell &amp; HP BitLocker Recovery Storms<\/strong><\/h4>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The Fracture:<\/strong> Enterprise laptops and desktops from Dell (especially Latitude\/Precision) and HP (EliteBook) are bypassing the normal boot sequence and booting directly into the blue <strong>BitLocker Recovery<\/strong> screen on the first reboot post-patch [cite: 1.3.3].<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The Root Cause:<\/strong> The firmware on these specific devices fails validation checks when the boot manager transitions to the newly staged cryptographic revocation list (DBX) [cite: 1.1.1, 1.3.3]. Because the PCR registers change value during this update, BitLocker detects a potential tampering attempt and locks down the system drive [cite: 1.3.3].<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The Preventative Remediation (Before Patching):<\/strong> If you have not pushed KB5094126 to your endpoints yet, you must suspend BitLocker protectors temporarily [cite: 1.3.3]:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Suspend-BitLocker -MountPoint \"C:\" -RebootCount 1\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The Emergency Recovery (Post-Patch Lockout):<\/strong> If the device is already locked, you have no choice but to retrieve the recovery key from Active Directory, Azure AD, or your escrow system [cite: 1.3.3].<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Once booted back into Windows, force a policy refresh using PowerShell to clean up the pending UEFI key staging:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><code>Confirm-SecureBootUEFI\n<\/code><\/code><\/pre>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>VIGILANCE NOTE:<\/strong> Do not simply turn off Secure Boot permanently to resolve these loops. Doing so strips your OS of modern credential guard protections and opens the kernel to local privilege escalation attacks (like <em>GreenPlasma<\/em> and <em>YellowKey<\/em>). Patch your hypervisors and firmware instead [cite: 1.2.3].<\/p>\n<\/blockquote>\n","protected":false},"excerpt":{"rendered":"<p>OVERSEER NOTE: June 2026 is witnessing one of the most operationally disruptive certificate rotations in Microsoft history. With the deployment of the June Cumulative Update (KB5094126 \/ KB5094125), Microsoft has pushed the wide-scale enforcement of the Secure Boot 2023 certificate rotation [cite: 1.1.1]. The result is a direct collision between decade-old UEFI hardware trust anchors, &#8230; <a title=\"INTEL ENTRY 006: THE SECURE BOOT ROTATION CRISIS (KB5094126)\" class=\"read-more\" href=\"https:\/\/patchtuesdayfallout.com\/archives\/2026\/06\/15\/intel-entry-006-the-secure-boot-rotation-crisis-kb5094126\/\" aria-label=\"Read more about INTEL ENTRY 006: THE SECURE BOOT ROTATION CRISIS (KB5094126)\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"pagelayer_contact_templates":[],"_pagelayer_content":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-51","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/patchtuesdayfallout.com\/archives\/wp-json\/wp\/v2\/posts\/51","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/patchtuesdayfallout.com\/archives\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/patchtuesdayfallout.com\/archives\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/patchtuesdayfallout.com\/archives\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/patchtuesdayfallout.com\/archives\/wp-json\/wp\/v2\/comments?post=51"}],"version-history":[{"count":1,"href":"https:\/\/patchtuesdayfallout.com\/archives\/wp-json\/wp\/v2\/posts\/51\/revisions"}],"predecessor-version":[{"id":53,"href":"https:\/\/patchtuesdayfallout.com\/archives\/wp-json\/wp\/v2\/posts\/51\/revisions\/53"}],"wp:attachment":[{"href":"https:\/\/patchtuesdayfallout.com\/archives\/wp-json\/wp\/v2\/media?parent=51"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/patchtuesdayfallout.com\/archives\/wp-json\/wp\/v2\/categories?post=51"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/patchtuesdayfallout.com\/archives\/wp-json\/wp\/v2\/tags?post=51"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}