CVE-2026-45642

Name of the Vulnerable Software and Affected Versions Microsoft Azure Attestation service (affected versions not specified) Device Health Attestation Service (affected versions not specified)

Description Improper input validation in these services allows an authorized attacker to perform spoofing via a physical attack. Specifically, certain metrics may accept attacker-controlled measurements, enabling a malicious bootkit to spoof the SecureBoot status as ON.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.