A vulnerability rated 9.5 out of 10, CVE-2026-97631, has been found in the PXE driver of TianoCore EDK II, the open-source code on which the UEFI firmware of most servers is based. Specially crafted ICMP error messages during network boot can lead to code execution before the operating system loads. Systems that boot over the network are affected, not those that start only from disk. The fix has been merged into the EDK II code, but firmware updates from manufacturers are expected to take months.

What it means: Firmware flaws are among the hardest to manage. The code runs before the operating system, so ordinary security tools do not see it, and an attacker who controls it can survive even a reinstall. In addition, the fix does not come from a single supplier: it has to travel from EDK II to firmware makers and from there to every server brand, which takes months. The good news is that the attack requires network boot, which is used mainly in data centres for automated machine installation, not in the daily running of most offices. For Greek companies and hosting providers with their own servers, the immediate steps are practical: turn off PXE where it is not needed, isolate machine provisioning networks from the rest of the network, and follow announcements from manufacturers such as Dell, HPE, Lenovo and Supermicro for new firmware versions. For those renting cloud infrastructure, responsibility lies with the provider, but it is worth asking for its patching timeline.

Read the original on Ars Technica

Related service: Custom software

Related stories