CVE-2026-6485

HighCVSS 8.2/10Last modified Sep 10, 2026

Description

UEFI BIOS embedded Shell could be used to bypass Secure Boot via shell commands or startup scripts.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-489

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Insyde SoftwareInsydeH2OSee in the Solution

References

Timeline

Published
Sep 9, 2026
Last modified
Sep 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-648508.7Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php sends an editoCVE-2026-648518.5Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. PriCVE-2026-648528.7Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API pluginCVE-2026-648558.2soapbar is a SOAP library for Python — client, server, and WSDL handling. Prior to version 0.13.0, verify_envelope_bsp() derived its trust aCVE-2026-648563.7FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.20.0, FileRise /api/file/CVE-2026-648575.3tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user'sCVE-2026-648585.3vulnerability-operator scans SBOMs and Images for vulnerabilities. Prior to version 0.28.16, an unauthenticated information-disclosure vulneCVE-2026-648599.1New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.7, the admin userCVE-2026-64863.5A vulnerability was detected in classroombookings up to 2.17.0. This impacts the function read of the file crbs-core/application/views/layouCVE-2026-648606.5ESP-Protocols is a collection of protocol components for ESP-IDF. Prior to mDNS version 1.11.2, the `mdns` component follows DNS name-compreCVE-2026-648614.3Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.222.0,CVE-2026-648626.5Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee dat
CVE-2026-6485: High severity, CVSS 8.2 | Vulnix