# CVE-2026-6485: Insyde InsydeH2O Secure Boot bypass via embedded shell

Source: https://junglewise.ai/threats/cve-2026-6485-insyde-insydeh2o-secure-boot-bypass-via-embedded-shell  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-6485 · Severity: high · CVSS 8.2 · Published 2026-09-09

Insyde's InsydeH2O is UEFI firmware used across many laptop and desktop computers. A vulnerability in the embedded shell allows a privileged local attacker to bypass Secure Boot protections, potentially enabling malicious code to run at the lowest system level before the operating system loads. This could allow unauthorized access to sensitive data or complete system compromise.

Technologies: [InsydeH2O](https://junglewise.ai/threats/technologies/insydeh2o). Vendors: [Insyde](https://junglewise.ai/threats/vendors/insyde).

## Quick answers

**Is CVE-2026-6485 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6485 being exploited in the wild.

**How severe is CVE-2026-6485?** High severity, with a CVSS score of 8.2, published 9 September 2026.

**Which products and versions are affected?** InsydeH2O Kernel 5.2 before 05.2B.17, Kernel 5.3 before 05.3A.17, Kernel 5.4 before 05.48.17, Kernel 5.5 before 05.56.17, Kernel 5.6 before 05.63.17, Kernel 5.7 before 05.72.17.

**Is there a fix for CVE-2026-6485?** A patch was published on 2026-09-08: Patches released for all affected kernel versions Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-6485 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2026-6485?** Check whether you run InsydeH2O at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the UEFI BIOS embedded shell component, where active debug code (CWE-489) allows shell commands and startup scripts to bypass Secure Boot verification. The attack requires high-level privilege (firmware/BIOS access) and local system access, with no user interaction needed. An attacker with these privileges can execute arbitrary UEFI shell commands to disable or circumvent Secure Boot mechanisms, enabling persistent code execution at boot time before OS security controls take effect. Patches are available across all affected Kernel versions (5.2 through 5.7) with specific patched versions identified by Insyde.

## Affected products

- Insyde InsydeH2O Kernel 5.2 before 05.2B.17, Kernel 5.3 before 05.3A.17, Kernel 5.4 before 05.48.17, Kernel 5.5 before 05.56.17, Kernel 5.6 before 05.63.17, Kernel 5.7 before 05.72.17

## Timeline

- 2026-09-08: disclosed
- 2026-09-08: patched: Patches released for all affected kernel versions

## References

- [https://www.insyde.com/security-pledge/sa-2026004/](https://www.insyde.com/security-pledge/sa-2026004/)

## Related threats

- [Insyde InsydeH2O memory boundary validation vulnerability](https://junglewise.ai/threats/cve-2026-12855-insyde-insydeh2o-memory-boundary-validation-vulnerability)
- [Insyde InsydeH2O buffer overflow in PlatformLangCodes UEFI variable handling](https://junglewise.ai/threats/cve-2021-43614-insyde-insydeh2o-buffer-overflow-in-platformlangcodes-uefi)
- [Insyde InsydeH2O password hash exposure in SysPasswordDxe](https://junglewise.ai/threats/cve-2021-43613-insyde-insydeh2o-password-hash-exposure-in-syspassworddxe)
- [Insyde InsydeH2O plaintext HDD password storage in UEFI variable](https://junglewise.ai/threats/cve-2021-38489-insyde-insydeh2o-plaintext-hdd-password-storage-in-uefi-variable)
- [Insyde InsydeH2O buffer overflow in SMM IHISI FMTSWriteUseIntelLib](https://junglewise.ai/threats/cve-2026-9805-insyde-insydeh2o-buffer-overflow-in-smm-ihisi-fmtswriteuseintellib)