Ethical Hacking News
A 16-year-old UEFI flaw (CVE-2026-97631) has been exposed, allowing attackers to run malicious code before the operating system loads and before security protections are fully active. The flaw, which affects some systems that start up over a network using EDK2-based firmware with PXE enabled, can lead to arbitrary code execution, corruption of memory, and impact Confidentiality, Integrity, and Availability. Organizations are advised to contact their system or firmware supplier, disable network boot, and monitor logs for suspicious activity to minimize the risk of exploitation.
A critical UEFI firmware vulnerability (CVE-2026-97631) has been exposed, affecting most servers. The 16-year-old buffer overflow flaw enables pre-OS code execution, allowing attackers to run malicious code before the operating system loads. The attack can be launched from a remote network, potentially leading to arbitrary code execution and impact on Confidentiality, Integrity, and Availability. Home and small-office users, as well as those who boot only from a disk drive, are not affected. Organizations should disable network boot, monitor logs for suspicious activity, and ensure Secure Boot and TPM are in place.
A critical vulnerability in the firmware that boots most of the world's servers has been exposed, leaving many organizations and individuals vulnerable to attack. The flaw, tracked as CVE-2026-97631, is a 16-year-old buffer overflow in the PXE-Base Code driver (NetworkPkg/UefiPxeBcDxe) of the TianoCore EDK II firmware. This firmware is widely used across the industry, including by major UEFI vendors such as AMI, Insyde, and Phoenix.
The vulnerability, which has a CVSS score of 9.5/10, enables pre-OS code execution, allowing attackers to run malicious code before the operating system loads and before security protections such as Secure Boot are fully active. This could potentially lead to arbitrary code execution, corruption of memory, and impact Confidentiality, Integrity, and Availability.
The attack is simple, as an attacker can send a direct message to the target's IP address during the PXE boot process, even from a remote network. Sending invalid data can stop the boot process and cause a denial of service. If the attacker knows the target's firmware version, they can create a fake event to run their own code at ring 0, the CPU's highest privilege level. This bypasses attestation, which uses cryptographic checks to prove that the hardware is trustworthy.
The flaw affects some systems that start up over a network using EDK2-based firmware with PXE enabled. Home and small-office users, and anyone who boots only from a disk drive, are not affected.
Researchers planned to disclose the bug in January, but AMI published a fix last month, revealing details of the flaw. TianoCore then issued a public warning, but attackers can now study the fix to develop exploits, while updating firmware across many devices could take a long time.
Organizations should contact their system or firmware supplier and disable network boot where possible. They should also monitor logs for suspicious activity. TPM and Secure Boot remain useful protections, but they do not stop this attack.
The exposure of this vulnerability highlights the importance of regularly updating firmware and monitoring for potential security threats. It also underscores the need for organizations to implement robust security measures, including Secure Boot and TPM, to protect their systems and data.
In conclusion, the 16-year-old UEFI flaw threatening servers is a critical vulnerability that requires immediate attention from organizations and individuals. By understanding the nature of the attack and taking proactive steps to protect themselves, they can minimize the risk of exploitation and ensure the security and integrity of their systems.
Related Information:
https://www.ethicalhackingnews.com/articles/Exposed-The-16-Year-Old-UEFI-Flaw-Threatening-the-Global-Server-Landscape-ehn.shtml
https://securityaffairs.com/201928/security/cve-2026-97631-16-year-old-uefi-flaw-threatens-servers.html
https://nvd.nist.gov/vuln/detail/CVE-2026-97631
https://www.cvedetails.com/cve/CVE-2026-97631/
Published: Wed Oct 28 08:03:10 2026 by llama3.2 3B Q4_K_M
