Baton Drop is the name associated with CVE-2022-21894, a Windows Secure Boot security feature bypass vulnerability. It involves a vulnerable boot component that can be used to get around Secure Boot protections, which are intended to allow only trusted software to run during startup. Microsoft and other researchers have associated the vulnerability with Secure Boot bypass activity involving BlackLotus.
The issue matters because attackers who compromise the boot process may gain persistence before the operating system and many endpoint defenses start. Defenders should apply relevant security updates and check that Secure Boot mitigations, including applicable boot-component revocations, are deployed and active. In the article context, Baton Drop is technical background for understanding Secure Boot bypasses; it does not independently establish that BlackX used this vulnerability.