Event details
I have seen a few devices where everything is ticked after updates got applied , in detection script but only red X is the Default UEFI DB has "Microsoft Option ROM UEFI CA 2023" not ticked do I have issue ? Seeing same on VM ESX 8 with nvram renamed. but everything else green on default and KEK got updated correctly as well.
Did the machine have the old 2011 equivalent of the option rom certificate? If not, it won't get the new one.
Also for a VM you won't need the Option ROM CA, and default db is not updated by the updates at all anyway (only by UEFI vendor).