CVE-2026-97631 - critical security vulnerability in the EDK II UEFI firmware component

Summary

CVE-2026-97631 - critical security vulnerability in the EDK II UEFI firmware component

A critical security vulnerability has recently been identified in the EDK II UEFI firmware component (CVE-2026-97631, CVSS 9.5). Further details can be found in the advisory: https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m What is affected? The vulnerability affects systems that boot over the network using PXE. During the boot process, an attacker may be able to execute malicious code through specially crafted network packets, even before the operating system and its security mechanisms (e.g., Secure Boot) are active. Systems that are already running are not directly at risk; the vulnerability can only be exploited during a PXE boot. An official patch is not yet available. What do we recommend? As an immediate precautionary measure, we recommend avoiding reboots of your hosts until further notice if they use PXE boot. What happens next? We are currently analyzing the impact on our environment and developing further recommendations and additional protective measures. We will inform you promptly as soon as new findings or updates become available.

• Started

  Oct 28, 2026 · 5:08 PM

• Status

  Investigating

• Duration

  Ongoing

• Severity

  None

• ◐

  Investigating

  Oct 28 · 5:08 PM Hetzner

  A critical security vulnerability has recently been identified in the EDK II UEFI firmware component (CVE-2026-97631, CVSS 9.5). Further details can be found in the advisory: https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m What is affected? The vulnerability affects systems that boot over the network using PXE. During the boot process, an attacker may be able to execute malicious code through specially crafted network packets, even before the operating system and its security mechanisms (e.g., Secure Boot) are active. Systems that are already running are not directly at risk; the vulnerability can only be exploited during a PXE boot. An official patch is not yet available. What do we recommend? As an immediate precautionary measure, we recommend avoiding reboots of your hosts until further notice if they use PXE boot. What happens next? We are currently analyzing the impact on our environment and developing further recommendations and additional protective measures. We will inform you promptly as soon as new findings or updates become available.