Both bootkits exploit "Baton Drop" (CVE-2022-21894), a logic flaw in the Windows boot manager Microsoft patched in 2022; Microsoft's 2023–24 mitigations added a new signing certificate (Windows UEFI CA 2023) and a path to revoke trust in the older Windows Production PCA 2011 certificate — but these only protect systems where administrators manually activate the revocations after installing the patches.