A serious vulnerability in widely used UEFI firmware lets attackers target servers before the operating system loads. The security flaw has a severity score of 9.5 and can grant attackers access to the most privileged parts of a system. Data centers and organizations that boot servers over a network are particularly at risk.
This was reported by Ars Technica. The vulnerability, registered as CVE-2026-97631, affects TianoCore EDK II. This open-source code is used worldwide by server hardware manufacturers and UEFI firmware vendors. AMI, Insyde, and Phoenix, among others, use EDK II components. It is not yet clear exactly which systems are vulnerable.
The flaw has existed for sixteen years (!) and lies in the software that lets computers boot over a network. This technique, known as PXE, is widely used in data centers to centrally deploy and manage servers.
During the boot process, the firmware processes ICMP messages, among other things. Because of an error in how the firmware processes these messages, attackers can write more data to memory than is available. This causes a buffer overflow that attackers can exploit to execute malicious code.
Bypassing security
The main danger lies in the attack’s timing. The malicious code can execute before the operating system is active and before the usual security checks complete.
A successful attack could therefore grant access to sensitive system components, including the Trusted Platform Module (TPM). Attackers may also install additional malware that activates during subsequent boot sequences.
That said, this does not mean that every server can be taken over remotely. Attackers must have access to the relevant network and typically need to tailor their attack to the target’s firmware version and hardware configuration. The vulnerability therefore poses a risk primarily when attackers have already gained access to a corporate network.
Under certain circumstances, security researchers say the vulnerability can be exploited to bypass existing security measures or gain elevated system privileges.
Patching may take a long time
The vulnerability was discovered by researchers at Anthropic and Google. They originally intended to disclose the issue in January, to give manufacturers sufficient time to prepare updates.
That plan was derailed when firmware supplier AMI prematurely published code that could fix the problem. As a result, the vulnerability’s technical details were also revealed. The TianoCore project subsequently decided to issue a security advisory.
Although the necessary code fix is relatively simple, rolling out updates could prove complicated. Numerous manufacturers use EDK II and must implement the changes individually in their firmware. Furthermore, some older servers may no longer receive security support.
Intel states that, to the best of its knowledge, its currently supported commercial products are not affected. However, the company does not rule out the possibility that manufacturers may have incorporated vulnerable components into their own firmware.
Organizations should check with their hardware vendors to determine whether their systems are vulnerable. Until updates are available, temporarily disabling PXE network boot can mitigate the risk. Systems that boot exclusively from local storage media are not affected by this specific vulnerability.