Critical UEFI Firmware Flaw Rated 9.5/10 Could Allow Code Execution on Servers Before Boot

Picture a server sitting in a rack — in a hospital basement, a council data centre, or a cloud facility somewhere in the English countryside. Before it runs Windows, Linux, or anything else, a small piece of firmware wakes it up. That firmware is where CVE-2026-97631 lives. And it was quietly broken for a very long time.

The vulnerability sits inside TianoCore EDK II, an open-source reference codebase that forms the foundation of UEFI firmware shipped by some of the biggest names in the industry: AMI, Insyde Software, and Phoenix Technologies all build their products on top of it. So does Microsoft’s own hardened firmware project, Project Mu. The flaw, buried in the code that handles ICMP messages during network booting, has been rated 9.5 out of 10 for severity by TianoCore’s own advisory team. That’s not a number that gets handed out lightly.

What the Flaw Actually Does

The problem lies in how the affected code handles network boot traffic. When a machine boots over a network — using a process called PXE, which lets a computer load its operating system from a remote server rather than a local hard drive — it receives ICMP messages as part of that process. The vulnerable component copies incoming data into a fixed memory area of just 504 bytes without properly checking whether the incoming data actually fits. Send a malformed ICMP error message, and you can overflow that buffer.

That’s the crash. But the deeper worry is what comes after.

An attacker who understands the precise layout of a specific firmware build could, in theory, use that overflow to execute their own code. Not inside the operating system. Before it. Code running at this stage operates outside the protections that Secure Boot and conventional security software apply later in the startup process. It’s a bit like slipping a note under a locked door before the occupant even wakes up to check who’s at the entrance.

Ars Technica reported on the vulnerability based on the TianoCore advisory, which was made public on 22 October 2026. The advisory describes a scenario where a transient attack payload might vanish after a reboot — but a more sophisticated attacker with sufficient access could potentially embed something that persists at the firmware level, creating a longer-term compromise.

Who Is Affected

The short answer: a very large portion of the server market.

EDK II is not one company’s product. It’s the shared plumbing beneath a big slice of the industry’s UEFI firmware. AMI, Insyde, and Phoenix are the three dominant independent BIOS and UEFI vendors globally; if any of their products incorporate the vulnerable ICMP component, those products are potentially exposed. Microsoft’s Project Mu — a hardened, security-focused fork of EDK II used in some of the company’s own platforms — was also found to contain the vulnerable code.

Some reporting has described this as affecting “most servers on planet Earth.” That’s a broad characterisation of EDK II’s widespread use rather than a verified count of vulnerable machines, and no complete list of affected models, firmware versions, or cloud platforms has been confirmed.

No evidence of widespread exploitation in the wild has emerged so far.

The Fix — and Why It’s Complicated

A fix was merged into the EDK II source code on 15 October 2026, a week before TianoCore published its public advisory. Microsoft reported that Project Mu builds containing the fix were available by 26 October 2026.

But here’s the catch. Merging a fix into open-source code is only the first step. The patch then needs to be picked up by each firmware vendor — AMI, Insyde, Phoenix, and others — who must test it against their own products and release updated firmware. Those updates then need to reach server manufacturers and motherboard makers, who must in turn push them to customers. Updating the operating system alone does nothing. The firmware itself must be flashed.

Dan Goodin, security editor at Ars Technica, has covered how the public availability of both the vulnerability details and the fix code may help defenders understand the risk — but could equally help advanced attackers develop working exploits more quickly. The clock is ticking in both directions.

Security practitioners advise disabling PXE and network boot on any server where it isn’t operationally necessary. The UEFI Forum’s own published guidance recommends protecting firmware flash writes, locking relevant hardware protections, and keeping Secure Boot settings properly configured. Where network boot is genuinely needed — for remote provisioning, fleet management, or disaster recovery — organisations should assess the risk carefully and prioritise firmware updates from their hardware vendors.

What This Means for Kent Residents

Organisations across Kent that run their own servers — including NHS Kent and Medway ICB, Kent County Council, Medway Council, district authorities, universities, and private-sector businesses — should check with their hardware vendors whether their firmware is based on affected EDK II code and whether updated firmware is available. IT administrators should review whether PXE or network boot is enabled on machines where it isn’t needed, and apply vendor-validated firmware updates as they become available. Cloud-hosted services used by Kent residents and businesses may also run on infrastructure affected by this flaw, though no specific UK provider has been confirmed as vulnerable. The National Cyber Security Centre’s guidance on firmware security is the appropriate starting point for any local public-sector body reviewing its exposure.