CVE-2020-26200: Kaspersky Endpoint Security

Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days.

A component of Kaspersky custom boot loader allowed loading of untrusted UEFI modules due to insufficient check of their authenticity. This component is incorporated in Kaspersky Rescue Disk (KRD) and was trusted by the Authentication Agent of Full Disk Encryption in Kaspersky Endpoint Security (KES). This issue allowed to bypass the UEFI Secure Boot security feature. An attacker would need physical access to the computer to exploit it. Otherwise, local administrator privileges would be required to modify the boot loader component.

Affected products

• Kaspersky Endpoint Security: version 10 only; version 11.0.0 only; version 11.0.1 only; version 11.1.0 only
• Kaspersky Rescue Disk: before 18.0.11.3 (fixed in 18.0.11.3)

Published 2021-02-26. Last modified 2026-06-17.