The critical flaw in UEFI firmware—used by most server vendors and data centers—allows attackers to execute code early in the boot process.
Read more →
A computer vulnerability that had been hidden for 16 years has alerted security officials on numerous servers. The failure affects a component used during the booting of computers and could allow the execution of malicious code before some of its main protections come into operation.
The critical vulnerability, tracked under the code CVE-2026-97631, targets the PXE driver in TianoCore EDK II. An attacker gaining access to the local network can execute UEFI-level code before the operating system boots.
A critical error allows the simple takeover even before the start of the computer. The gap remained unnoticed for 16 years and was now prematurely public due to an accident.