Technology and Science14 July, 20263 min read
Microsoft Says Salesforce OAuth Approval Lets Attackers Persistently Access Customer Records
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
A single Salesforce OAuth approval allowed attackers durable access to customer records. Attackers exploited trusted app connections via OAuth, not a software flaw.
OAuth Approval Persists
Microsoft says one mistaken approval inside Salesforce can give attackers a quiet, durable route into a company’s most sensitive customer records by abusing trusted OAuth relationships rather than exploiting a Salesforce software flaw. In campaigns tied to tradecraft associated with ShinyHunters, Microsoft observed activity from mid-2025 to mid-2026 across organizations in retail, education, manufacturing, and other sectors, using voice phishing, compromised SaaS integrations, and overly broad guest access to reach Salesforce environments. Microsoft said attackers began by calling employees while posing as IT support and persuaded targets to authorize an attacker-controlled connected application made to look like a legitimate Salesforce Data Loader tool.
Once approved, Microsoft said the malicious app can enumerate a victim’s Salesforce instance, make API calls in that user’s name, retain access, and potentially expose credentials that open paths to other cloud services. Microsoft also said the resulting API traffic comes through an approved application, so routine sign-in monitoring may not recognize it as hostile, and the access can be used to collect accounts, contacts, and service case data.
UEFI Shims Bypass Secure Boot
ESET researchers found 11 old and forgotten UEFI shim bootloaders at versions 0.9 and below that can be used to bypass UEFI Secure Boot on any UEFI-based machine that trusts Microsoft’s Microsoft Corporation UEFI CA 2011 certificate authority. WeLiveSecurity reported that exploitation of the vulnerable shims can execute untrusted code during system boot, enabling attackers to deploy malicious UEFI bootkits such as Bootkitty, HybridPetya, or BlackLotus even when UEFI Secure Boot is enabled. ESET said it reported the findings to CERT/CC in February 2026, and the vulnerable UEFI applications were revoked on Microsoft’s June 9th, 2026 Patch Tuesday.
The shims were revoked under two CVE IDs, CVE-2026-8863 and CVE-2026-10797, and the bypass works because attackers can bring their own copy of the vulnerable binaries to any UEFI system with the Microsoft third-party UEFI certificate enrolled. Ars Technica said ESET identified 11 firmware images, at least one from 2013, that were known to be defective but remained signed by Microsoft anyway, allowing the protection embedded into UEFI to be circumvented.
Fixes, Indicators, and Risk
Microsoft’s June 9th, 2026 Patch Tuesday revocation of the vulnerable shims is part of a broader Secure Boot remediation timeline that WeLiveSecurity says included a CERT/CC Vulnerability Note published on 2026-06-09 and a blogpost published on 2026-07-14. ZDNET said Microsoft’s April Patch Tuesday updates added a visual indicator so Windows can tell whether Secure Boot is functioning correctly, with the Secure Boot icon appearing in green, yellow, or red depending on status. ZDNET also said the April Windows update fixes no fewer than 164 security vulnerabilities, including eight classified as critical and two considered zero-day vulnerabilities, making the release one that requires immediate attention.
Ars Technica warned that the shim can be used to completely circumvent the protection embedded into the UEFI of a device’s motherboard, and that an attacker can subvert the mandated chain of digitally signed firmware to install malicious firmware that loads early in the boot process. For device owners, ZDNET said the practical step is to install the latest Windows updates so the new Secure Boot certificates are applied, and it noted that in June the old ones will expire, which means Secure Boot will no longer be able to protect properly.