Ethical Hacking News
Most Servers on the Planet Are Vulnerable to This Firmware Code-Execution Flaw
CVE-2026-97631 is a severe UEFI firmware vulnerability with a severity rating of 9.5 out of 10, exposing millions of servers worldwide to a critical code-execution flaw. The vulnerability resides in the TianoCore EDK II, an open-source codebase used by most server vendors and data centers, potentially affecting well-known companies like AMI, Insyde, and Phoenix. The vulnerability allows attackers to execute malicious code before the operating system and firmware can implement defenses like Secure Boot, giving them access to servers as they start up. The discovery of CVE-2026-97631 highlights the need for immediate attention and action from the tech industry, governments, and organizations to address this pressing issue. Patching UEFI code vulnerabilities in millions of end devices is cumbersome and time-consuming, making it trivial for advanced hackers to learn how the vulnerability is triggered and build working exploits. CVE-2026-97631 joins a long list of previously discovered vulnerabilities in UEFI or code that works closely with it, including LogoFail, PixieFail, PKFail, BootHole, and BlackLotus. The vulnerability is not directly applicable to Arm's product portfolio, but it's prudent for users of all servers to investigate if CVE-2026-97631 affects them.
CVE-2026-97631, a severe UEFI firmware vulnerability, has been identified, exposing millions of servers worldwide to a critical code-execution flaw. This alarming discovery highlights the need for immediate attention and action from the tech industry, governments, and organizations to address this pressing issue.
The vulnerability, which has a severity rating of 9.5 out of 10, resides in the TianoCore EDK II, an open-source codebase used by most server vendors and data centers. This means that virtually all UEFI suppliers, including well-known companies like AMI, Insyde, and Phoenix, are potentially affected by this critical flaw.
According to the researchers who discovered the vulnerability, Alex Matrosov of Anthropic and Dan Holmes of Google, it is a memory-corruption flaw in an ICMP component that attackers can exploit to execute malicious code before the operating system and firmware can implement defenses like Secure Boot. This allows attackers to access servers as they start up, giving them a wide opening to install other payloads that run each time early in the boot process.
"This vulnerability in the ICMP parser of the EDK2 network stack is interesting in terms of how it affects the chain of trust and the broader ecosystem," said HD Moore, creator of Metasploit and chief research officer at security firm Dragos. "An attacker intent on compromising a nearby endpoint or server could use this bug to hijack program flow at a point where the boot process still has access to sensitive components, like the endpoint's TPM. This could be used to break disk encryption for cases where an attacker has short-term network access (and it would be even easier in a theft scenario)."
The Cat Has Left the Bag
The parties that discovered CVE-2026-97631—Alex Matrosov of Anthropic and Dan Holmes of Google—had arranged for it to stay under wraps until a coordinated disclosure that was scheduled for January. However, AMI, a maker of motherboards and other hardware, published this pull request last month that detailed the vulnerability and included a code fix. Once the post came to the attention of the discovering parties, TianoCore Project members published a public advisory last week.
With publicly available patch code, it will be trivial for advanced hackers to learn how the vulnerability is triggered and to build working exploits. Further compounding the urgency, patching UEFI code vulnerabilities in millions of end devices sold and used by thousands of hardware makers and cloud providers is cumbersome and time-consuming.
"This vulnerability in the ICMP parser of the EDK2 network stack is interesting in terms of how it affects the chain of trust and the broader ecosystem," said HD Moore, creator of Metasploit and chief research officer at security firm Dragos. "An attacker intent on compromising a nearby endpoint or server could use this bug to hijack program flow at a point where the boot process still has access to sensitive components, like the endpoint's TPM. This could be used to break disk encryption for cases where an attacker has short-term network access (and it would be even easier in a theft scenario)."
CVE-2026-97631 joins a long list of previously discovered vulnerabilities in UEFI or code that works closely with it. The most severe of them, LogoFail, stemmed from logo images included in the UEFI of just about every hardware maker. Rendering bugs allowed attackers to subvert the chain of trust UEFI enforces and go on to install malicious components before the OS loaded or Secure Boot ran.
PixieFail was a vulnerability similar to CVE-2026-97631. It, too, was the result of faulty PXE boot flaws in EDK2. Following discovery of the vulnerability, researchers embarked on multiple fuzzing projects designed to surface other critical flaws in the open-source code library. It appears those efforts failed to find this latest flaw.
Other recently discovered UEFI flaws include PKFail, a supply-chain failure resulting from non-production test platform keys, public for more than a decade before they were discovered, used in hundreds of device models; BootHole; Bootkit; and BlackLotus.
Like CVE-2026-97631, exploitation or use of these payloads is appealing because it allows attackers to infect machines early in the boot process, before TPM and other defenses load, so they can inflict maximum damage. Given the ubiquity of CVE-2026-97631, Moore said it's likely a "forever" bug that will live on in end-of-support systems.
"There are important caveats and limitations to exploiting this latest vulnerability. As noted, some level of control over a local network is a prerequisite. That likely limits exploitation to insiders or attackers, such as nation-states or ransomware operators, who manage to gain low-level access inside a network and are looking for a way to elevate system rights. There's no evidence yet that CVE-2026-97631 provides an initial entry point into a network. There are other hurdles to clear."
"For exploiting the vulnerability itself, an attacker needs to guess specific addresses within the target system, so it's not something that you can throw a single exploit at any target and get RCE across a diverse range of devices, but it needs to be tuned for each target model/version/configuration since the addresses will change based on those," Jesse Michael, a principal researcher at firmware security firm Eclypsium, told Ars.
"Unlike some of the previous, high-profile vulnerabilities like BootHole, Black Lotus, and Baton Drop, this vulnerability can be fixed with a basic code fix, which will require deploying a BIOS/UEFI update, but they don't need to deal with revocations, pk/kek/db/dbx key management updates, or making sure to update OS and provisioning media like you do with Secure Boot bypasses in the bootloader itself."
CVE-2026-97631 doesn't affect home and small office users, or any other users who boot their devices solely from disk drives. Instead, it applies only to organizations with machines that boot from local networks, or conceivably from Internet-connected resources. Even then, the targeted firmware must rely on EDK2, as opposed to a different reference implementation, and use the PXE functionality (which is turned on by default).
In an email, Intel said that none of its "commercial products currently under security support" are known to be affected. "Intel does not include the affected EDK2 functionality in its reference code, though it may be integrated by an OEM board vendor or system manufacturer," the company added. It advised customers to check with their system manufacturer for specific guidance. Publicly available Intel reference code, however, makes reference to EDK2. Further, TianoCore has said that each Intel-supplied UEFI development kit "is a fully validated implementation … for a specific revision of the EDK II source." Many other Intel documents reference EDK2 as well.
Arm, meanwhile, responded to a list of questions with: "CVE-2026-97631 is not directly applicable to Arm's product portfolio." Like Intel, firmware the company makes available also borrows heavily from EDK2. TianoCore has also documented Arm's reliance on EDK2.
While it’s possible some platforms are free of EDK2 code, it’s prudent for users of all servers to investigate if CVE-2026-97631 affects them.
Questions sent to AMD, Phoenix Technologies, AMI, Microsoft, and Amazon—likely some of the other biggest organizations affected—went unanswered when this post went live. Without concrete answers to questions about the use of EDK2 by organizations like these, it’s impossible to say what or how devices are affected and what actions, if any, these organizations, or their users, should take. Representatives from the TianoCore Project also didn’t respond.
Some readers are likely to be unhappy at the lack of detail. Sometimes—particularly in cases involving botched disclosures that break embargoes months before they’re scheduled to lift—there’s no escaping the lack of actionable information in initial reporting.
Those affected should check with the maker of the firmware being used to boot their systems and ask for guidance. Beyond that, they should consider turning off network boot capabilities at least temporarily if possible. Firmware configurations should always enable security features such as TPM and Secure Boot whenever possible, although those defenses don’t protect against this particular threat. It’s also a good idea to monitor logs for signs of exploitation attempts.
This story originally appeared on Ars Technica.
Related Information:
https://www.ethicalhackingnews.com/articles/Exposing-the-Critical-UEFI-Firmware-Vulnerability-Affecting-Millions-of-Servers-Worldwide-ehn.shtml
https://www.wired.com/story/most-servers-on-the-planet-are-vulnerable-to-a-code-execution-flaw-in-uefi-firmware/
Published: Wed Oct 28 16:50:40 2026 by llama3.2 3B Q4_K_M
