Microsoft Windows Secure Boot · Exploitation reported

Baton Drop fix breaks boot of Microsoft's Windows 11 26H2 install image

Nov 09, 2026 · 1 min read

Microsoft's own Windows 11 26H2 install image won't boot on PCs that applied the fix for the Baton Drop Secure Boot flaw, as spotted by analyst Will Dormann. The fix isn't automatic: Windows updates only prepare it and admins must enable it manually. Enabling it remains necessary, as Kaspersky reported the BlackX bootkit used Baton Drop against fully patched Windows machines at diplomatic agencies in Central Asia.

By HIFY Radar newsroom Updated 11/09/2026 11:29 PM Get this every day →← Back to the feed 1 source

HighVulnerabilityExploitation reportedPartial fix

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Microsoft's own Windows 11 26H2 install image fails to boot on PCs that applied the fix for the Baton Drop Secure Boot flaw, analyst Will Dormann reported. The error screen points users to a Microsoft help link that doesn't exist. The fix requires manual activation by admins after Windows updates.

Why it matters

Machines relying on the 26H2 image to reinstall or repair Windows may be unable to start installation. At the same time, skipping the fix keeps the risk: Kaspersky reported the BlackX bootkit used Baton Drop to break into fully patched Windows machines at diplomatic agencies in Central Asia.

What to do

Enable the Baton Drop fix manually after Windows updates; don't rely on Windows Update alone. Test booting the Windows 11 26H2 install image on PCs with the fix applied before depending on it for reinstalls or repairs.

For the technical team

Affected: Microsoft Windows Secure Boot (falha Baton Drop) e imagem de instalação do Windows 11 26H2 · PCs with the Baton Drop fix applied: Microsoft's Windows 11 26H2 install image won't boot on them. Reported Baton Drop targets: fully patched Windows machines at diplomatic agencies in Central Asia.
Exploitation: Exploitation reported by Kaspersky: the BlackX bootkit used Baton Drop to break into fully patched Windows machines at diplomatic agencies in Central Asia.
Fix: The Baton Drop fix ships via Windows updates but requires manual activation by admins. The source cites no fix for the 26H2 install image boot failure.
Vector: Windows Secure Boot, Baton Drop flaw. The fix arrives via Windows Update only in a prepared state: admins must enable it manually. The flaw allows boot-stage compromise, used by the BlackX bootkit on fully patched machines.
More details: The boot issue was spotted by vulnerability analyst Will Dormann, formerly of CERT/CC. The error screen sends users to a Microsoft help link that doesn't exist. Per the source, Kaspersky reported the BlackX case one month earlier.