GoKawiilCritical EDK II Firmware Flaw Exposes Most Servers to Boot-Time Code Execution
A memory-corruption vulnerability, CVE-2026-97631, rated 9.5 out of 10 in severity, has been found in the TianoCore EDK II codebase that underpins UEFI firmware used by nearly all major hardware vendors including AMI, Insyde, and Phoenix, as well as Microsoft's Project Mu fork. The flaw lies in an ICMP component and lets attackers run malicious code before Secure Boot and other defenses load, though the payload itself does not persist across reboots. A planned coordinated disclosure for January was disrupted when AMI published a pull request detailing the bug and its fix last month, prompting TianoCore to issue a public advisory last week.
GoKawiil's interpretation of the reporting above, not reported fact.
Because EDK II is embedded in the firmware of most servers and data centers globally, the vulnerability's reach is unusually broad, potentially affecting cloud providers and enterprise hardware across vendors. The premature public disclosure of patch code means attackers could reverse-engineer the fix faster than organizations can apply it, compressing the window defenders have to respond. Even though the initial exploit lacks persistence, it could serve as a foothold for installing other malware that survives reboots, which security researchers suggest raises the stakes considerably.
- CVE-2026-97631 scores 9.5/10 severity and affects the widely used TianoCore EDK II UEFI firmware codebase.
- A planned coordinated disclosure was undermined when AMI published a pull request with the vulnerability details and fix ahead of schedule.
- The flaw allows code execution before Secure Boot protections activate, though the initial payload does not persist across reboots.
Yubico YubiKey 5 NFC — With firmware-level exploits undermining trust chains like Secure Boot, hardware-backed authentication becomes even more critical for protecting admin accounts and privileged server access. A YubiKey adds a physical layer of security that's independent of compromised boot firmware, helping mitigate the fallout when low-level vulnerabilities like this one surface.
See Yubico YubiKey 5 NFC on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: wired.com — Dan Goodin, 2026-10-28
Published there as: “Most Servers on the Planet Are Vulnerable to This Firmware Code-Execution Flaw”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.