CVE-2026-97631
Allows code execution before OS defenses load in UEFI firmware.
A memory-corruption bug in TianoCore EDK II, the open source codebase behind most UEFI firmware, lets attackers execute malicious code before the operating system's defenses load. This affects most server vendors and data centers worldwide. The flaw has a critical severity rating of 9.5 out of 10, but is not on CISA's known-exploited list yet.
TianoCore EDK2 · Updated 28 Oct · From 1 of our story and the public records
Being exploitedNot reportedNo attacks reported in the records
CISA known exploitedNot listedThe US list of flaws under attack
SeveritycriticalCVSS 9.5 of 10
FixNot yetSee what to do below
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- Apply the firmware update from your server vendor as soon as it is released.
- If no update is available yet, there is no known workaround; follow vendor advisories for updates.
What happened
- 27 OctThe vulnerability is publicly disclosed with a critical 9.5 rating.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-97631 | Pre-boot RCE in EDK II PXE driver | critical 9.5 | No | 0.4% |
Our reporting
27 OctCode-execution flaw in boot-time firmware threatens most servers worldwideReported elsewhere
Ars Technica - All content · 27 OctCode-execution flaw in UEFI firmware threatens most servers on planet Earth ↗The records
CVE-2026-97631 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works