Microsoft Windows ELAM · Disclosed

[Single source] Seller claims Windows ELAM bypass zero-day chain for sale, $5,000

Nov 09, 2026 · 1 min read

A forum seller claims to sell two zero-days against ELAM, the Windows mechanism that validates anti-malware drivers at boot, for $5,000 for the full chain. There is no CVE, public code, or confirmation the exploits work. Monitor Microsoft advisories and keep systems updated.

By HIFY Radar newsroom Updated 11/09/2026 09:54 AM Get this every day →← Back to the feed 1 source

MediumVulnerabilityDisclosedFix unconfirmed

In 30 seconds

Alleged

A seller on the dbugs platform is offering an alleged 0-day exploit chain that claims to bypass Windows ELAM (Early Launch Anti-Malware) for $5,000, covering both exploits in the chain.

Alleged

The claimed chain has two parts: an 'ELAM Kill Switch' that fully disables or bypasses the ELAM mechanism, and a 'Driver Classification Exploit' that manipulates driver classification so a potentially malicious driver is accepted as legitimate. The seller claims the chain can bypass kernel security restrictions during boot and potentially achieve Ring 0 code execution. No technical proof or independent verification is present in the evidence batch.

What happened

Observed

A news item titled '0-Day Exploit Chain for Bypassing Windows ELAM for Sale' was published on dbugs (dbu.gs) on November 9, 2026, describing a marketplace listing.

Observed

The listing was promoted via an X post by user ptdbugs, which states a price of $5,000 for both exploits and summarizes the seller's description of the two-part chain targeting ELAM, the Windows mechanism responsible for early driver verification during OS boot.

Alleged

According to the seller's description, Part 1 is a complete disabling or bypass of ELAM ('ELAM Kill Switch') and Part 2 is a driver classification exploit that lets the system accept a potentially malicious driver as legitimate.

Why it matters

Alleged

ELAM is positioned in the listing as the Windows mechanism that verifies drivers early in the boot process; a working bypass could interfere with that verification and create conditions for covert kernel-level execution of malicious code that is harder for security tools to detect.

Alleged

The seller claims the chain could bypass kernel security restrictions during the Windows boot phase and potentially reach Ring 0, the most privileged execution level in the x86/x64 architecture, which would represent a high-impact capability if real.

Alleged

The discussion specifically names Microsoft Defender, Sophos, and Avast as products that rely on ELAM, implying a broad potential impact on consumer and enterprise endpoint protection if the claims hold.

What to do

Inferred

Treat the listing as unverified: no exploit code, technical write-up, or independent reproduction accompanies the offer in the available evidence, so no action should be based on the assumption that the chain works.

Inferred

Security teams tracking boot-chain threats can use this as a prompt to confirm ELAM-related protections and Secure Boot posture on managed Windows fleets, and to monitor dbugs and similar channels for follow-up from the seller or third-party analysis.

Confirmed and still uncertain

Observed

Known: a listing exists on dbugs announcing an alleged 0-day ELAM bypass chain, with a stated price of $5,000 for both exploits, promoted on X on November 9, 2026.

Inferred

Unknown: whether the exploits actually work, whether they are genuinely unknown (0-day) vulnerabilities, the seller's identity and track record, whether Microsoft or the named vendors are aware, and whether the listing leads to a sale or public disclosure. The claims are described only as 'allegedly working' by the announcer.

What people are saying

Alleged

The anonymous seller claims the two-exploit chain disables ELAM, manipulates driver classification, and potentially yields Ring 0 code execution during boot.

Observed

The X account ptdbugs, which surfaced the listing, characterizes the exploits as 'allegedly working' and highlights Microsoft Defender, Sophos, and Avast as ELAM-dependent products in the discussion.

Evolution

Observed

As of November 9, 2026, the publicly visible footprint consists of the original dbugs news item and a simultaneous X post by ptdbugs linking to it; no follow-up, price change, sale confirmation, or vendor response is present in the evidence batch.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Alleged

Per the listing, the chain targets ELAM (Early Launch Anti-Malware), the Windows mechanism responsible for early driver verification during OS boot, before most security software initializes.

Alleged

The claimed components are: Part 1, an 'ELAM Kill Switch' providing complete disabling or bypassing of the ELAM mechanism; and Part 2, a 'Driver Classification Exploit' that manipulates driver classification so the system accepts a potentially malicious driver as legitimate.

Alleged

The seller asserts the combined effect bypasses kernel security restrictions during the Windows boot phase and can potentially achieve code execution in Ring 0, the most privileged level of code execution in the x86/x64 processor architecture. No proof-of-concept, affected Windows versions, or vulnerability details are provided.

Sources and evidence

Observed

The evidence base is minimal: a primary RSS news item from dbugs (dbu.gs) whose body content was not available at ingestion, and one X post by ptdbugs that summarizes the listing, the $5,000 price, and the two claimed exploits.

Inferred

All substantive technical claims originate from the anonymous seller as relayed by these two items; nothing in the batch corroborates exploit functionality, 0-day status, or vendor impact, so the overall narrative should be treated as unverified marketplace claims.