BlackX Bootkit Infects Fully Patched Windows Systems
Security researchers report that the BlackX UEFI bootkit exploits the Baton Drop flaw to compromise Windows machines already updated with available patches.
Updated on Nov. 6, 2026 in Cybersecurity
Live Poll
Do you trust software companies to keep your devices secure after updates?
Researchers have identified infections involving the BlackX UEFI bootkit on fully patched Windows systems. BlackX exploits the Baton Drop vulnerability, tracked as CVE-2022-21894, which allows attackers to bypass Secure Boot.
Why it matters
The infections show that installing standard patches alone does not fully close the Baton Drop gap, because the older boot manager certificate remained trusted. Users and administrators must take additional manual steps to achieve full protection.
The Baton Drop flaw is tracked as CVE-2022-21894, and the extraction provides no infection count or baseline comparison for the BlackX activity. The scope of affected systems has not been quantified.
The players
Microsoft
Microsoft is the developer of the Windows operating system and issued the patches and certificate updates addressing the Baton Drop vulnerability.
The details
BlackX is a UEFI bootkit that exploits Baton Drop to bypass Secure Boot and compromise the boot manager. Microsoft first patched the flaw in 2022 but did not revoke trust in the older certificate used to sign vulnerable boot managers, a gap the predecessor bootkit BlackLotus had already exploited.
Timeline
Microsoft first patched the Baton Drop vulnerability in 2022.
Microsoft added a new certificate to block older vulnerable boot managers in 2023.
Microsoft provided a means to revoke trust in the old certificate in 2024.
The BlackX infection reports were published on November 6, 2026.
Big Picture
BlackX follows the same certificate trust gap that the BlackLotus bootkit exploited earlier, showing that unrevoked trust in older Secure Boot certificates has remained a recurring attack path. Microsoft's staged 2023 and 2024 updates reflect the difficulty of closing that gap without making devices unbootable.
Patching alone is not enough for full protection against Baton Drop, so Windows users and administrators must complete the additional manual steps Microsoft outlined to revoke trust in the older certificate. Failing to do so leaves systems exposed to boot-level compromise even when standard updates are installed.
The takeaway
Installing every available patch does not guarantee protection against boot-level threats like BlackX. Administrators should verify that the certificate revocation steps have been completed on their Windows systems.
Further reading
Explore more cybersecurity coverage to see how boot-level threats like BlackX fit into the broader threat landscape.
Source note: This article includes information reported by RocketNews.
Live Poll
Do you trust software companies to keep your devices secure after updates?
