Defenders worldwide are now grappling with another serious code‑execution vulnerability, this time embedded in the boot‑time firmware that powers the majority of server manufacturers and data centers. The flaw, rated 9.5 out of 10 for severity, resides in TianoCore’s EDK II, an open‑source codebase that hardware makers and cloud providers rely on to build the UEFI firmware that runs during system start‑up. A UEFI Forum representative described EDK II last year as “the preeminent solution / implementation of the UEFI specifications.” Almost every UEFI supplier—often referred to as independent BIOS vendors—such as AMI, Insyde and Phoenix incorporates the reference code heavily. Microsoft’s hardened fork, Project Mu, also used the component that contains the vulnerability.
Tracked as CVE‑2026‑97631, the issue is a memory‑corruption bug in an ICMP module that attackers can exploit to run malicious code before the operating system and firmware have a chance to activate defenses like Secure Boot. Secure Boot establishes a chain of trust for all code, including the Trusted Platform Module, loaded during boot. Although the payload delivered by CVE‑2026‑97631 does not persist—it executes only once—it can give threat actors a broad window to install additional payloads that run early in each boot cycle.