# CVE-2026-6484: Insyde InsydeH2O UEFI verified boot bypass

Source: https://junglewise.ai/threats/cve-2026-6484-insyde-insydeh2o-uefi-verified-boot-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-6484 · Severity: high · CVSS 8.2 · Published 2026-08-12

InsydeH2O is firmware used in enterprise and embedded systems. A flaw in the UEFI boot verification process allows an attacker with high privileges to bypass secure boot mechanisms and execute arbitrary code during system startup, potentially compromising the entire system integrity before the operating system even loads.

Technologies: [InsydeH2O](https://junglewise.ai/threats/technologies/insydeh2o). Vendors: [Insyde](https://junglewise.ai/threats/vendors/insyde).

## Quick answers

**Is CVE-2026-6484 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6484 being exploited in the wild.

**How severe is CVE-2026-6484?** High severity, with a CVSS score of 8.2, published 12 August 2026.

**Which products and versions are affected?** InsydeH2O Multiple versions affected; patched versions available for various Intel platforms (Alder Lake, Raptor Lake, Arrow Lake, Meteor Lake, Elkhart Lake, and others).

**Is there a fix for CVE-2026-6484?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-6484 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2026-6484?** Check whether you run InsydeH2O at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a lack of verified boot (CWE-1277: Insufficient Verification of Data Authenticity in Firmware) in certain firmware volumes (FV) within the UEFI implementation. The attack requires high privilege access (PR:H) and does not require user interaction. An attacker with sufficient privileges can bypass secure boot verification on affected firmware versions, leading to arbitrary code execution during the boot phase. The issue affects multiple Intel processor families and InsydeH2O firmware; patched versions are available from Insyde Software.

## Affected products

- Insyde InsydeH2O Multiple versions affected; patched versions available for various Intel platforms (Alder Lake, Raptor Lake, Arrow Lake, Meteor Lake, Elkhart Lake, and others)

## Timeline

- 2026-08-11: disclosed
- 2026-08-12: advisory: CVE-2026-6484 published

## References

- [https://www.insyde.com/security-pledge/sa-2026003/](https://www.insyde.com/security-pledge/sa-2026003/)

## Related threats

- [Insyde InsydeH2O Secure Boot bypass via embedded shell](https://junglewise.ai/threats/cve-2026-6485-insyde-insydeh2o-secure-boot-bypass-via-embedded-shell)
- [Insyde InsydeH2O memory boundary validation vulnerability](https://junglewise.ai/threats/cve-2026-12855-insyde-insydeh2o-memory-boundary-validation-vulnerability)
- [Insyde InsydeH2O buffer overflow in PlatformLangCodes UEFI variable handling](https://junglewise.ai/threats/cve-2021-43614-insyde-insydeh2o-buffer-overflow-in-platformlangcodes-uefi)
- [Insyde InsydeH2O password hash exposure in SysPasswordDxe](https://junglewise.ai/threats/cve-2021-43613-insyde-insydeh2o-password-hash-exposure-in-syspassworddxe)
- [Insyde InsydeH2O plaintext HDD password storage in UEFI variable](https://junglewise.ai/threats/cve-2021-38489-insyde-insydeh2o-plaintext-hdd-password-storage-in-uefi-variable)