Fully Patched Windows PCs Still Hit by BlackX
The bootkit exploits the Baton Drop flaw, showing that standard patches alone may not close Secure Boot gaps.
Updated on Nov. 6, 2026 in Cybersecurity
Live Poll
Do you trust software companies to keep your devices secure after updates?
Security researchers have identified infections by the BlackX UEFI bootkit on fully patched Windows systems. The bootkit exploits the Baton Drop vulnerability (CVE-2022-21894), which allows attackers to bypass Secure Boot. This development is documented in research reporting, not a new product.
Why it matters
The case shows that patching alone may not close a boot-level flaw when trust in an older signing certificate remains in place. It follows the predecessor BlackLotus bootkit, which exploited the same certificate trust gap.
The measurable identifier in the reporting is CVE-2022-21894, the tracking number for the Baton Drop flaw. The extraction does not provide infection counts, performance measures, or comparisons, so the scale of the exposure is not quantified.
The players
Microsoft
Microsoft builds Windows and its Secure Boot and boot-manager signing infrastructure, and issued the Baton Drop patches and certificate updates.
The details
BlackX is a UEFI bootkit, meaning malicious code that loads during the firmware stage before Windows starts. The Baton Drop flaw lets attackers bypass Secure Boot, the mechanism that checks boot components are signed by trusted certificates, and compromise the boot manager. Microsoft patched the flaw in 2022 but did not revoke trust in the older certificate used to sign vulnerable boot managers, leaving the gap that BlackX exploits.
Timeline
2022: Microsoft first patched the Baton Drop vulnerability.
2023: Microsoft issued an update adding a new certificate to block older vulnerable boot managers.
2024: Microsoft issued an update providing means to revoke trust in the old certificate.
The Tech Race
BlackX follows BlackLotus, a predecessor bootkit that exploited the same certificate trust gap in Secure Boot. The sequence shows attackers returning to a flaw that Microsoft began addressing with 2022, 2023 and 2024 updates.
Organizations that have installed all available patches may still need additional manual steps to gain full Baton Drop protection, according to the extraction. The extraction does not say when or how those steps will be simplified or enforced.
The takeaway
Installing every available patch may not be enough for Baton Drop, so administrators should check whether the manual steps for full protection have been completed. Watch for any follow-up Microsoft guidance on fully revoking the older certificate, given the risk of leaving millions of devices unbootable.
Further reading
For background on how attackers target systems below the operating system, see the Cybersecurity section.
Source note: This article includes information reported by RocketNews.
Live Poll
Do you trust software companies to keep your devices secure after updates?
