Skip to content
Critical UEFI Flaw CVE-2026-97631 Exposes Servers to Pre-OS Code Execution

Critical UEFI Flaw CVE-2026-97631 Exposes Servers to Pre-OS Code Execution

First seen 28 Oct 2026, 12:38 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 28, 2026 at 15:09 UTC
  • •CVE-2026-97631 is a critical UEFI firmware vulnerability with a CVSS score of 9.5.
  • •The flaw allows pre-OS code execution through ICMP error message exploitation.
  • •Patches were disclosed on October 22, 2026; immediate application is recommended.

A critical vulnerability, CVE-2026-97631, affects the UEFI firmware used in most servers globally, allowing pre-OS code execution via a 16-year-old buffer overflow in the PXE-Base Code driver. This flaw, with a CVSS score of 9.5, enables attackers to exploit ICMP error messages during the PXE boot process, potentially compromising sensitive components like the Trusted Platform Module (TPM). The vulnerability affects TianoCore EDK II, widely utilized by major vendors including AMI, Insyde, and Phoenix. Attackers with low-level network access can deliver malicious ICMP messages to execute arbitrary code before the operating system loads, bypassing security measures like Secure Boot. Patches for this flaw were disclosed on October 22, 2026, and organizations are urged to apply them immediately to mitigate risks. The vulnerability poses a significant threat to server integrity and security across various industries.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-22
CVE-2026-97631 published
The critical UEFI vulnerability was disclosed with a CVSS score of 9.5, affecting TianoCore EDK II.
Securityaffairs
2026-10-28
Vulnerability details reported
Articles detail the exploitation method and impact of CVE-2026-97631, urging immediate patch application.
Arstechnica

More articles in this cluster (10)

Following this threat?

Track TianoCore and CVE-2026-97631 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (11)

1 / 4

Common questions

Which systems are affected?
The vulnerability affects servers using TianoCore EDK II firmware, utilized by major vendors.
What is the attack vector?
Attackers can exploit ICMP error messages during the PXE boot process to execute arbitrary code.
How urgent is the patching process?
Immediate application of the patch is recommended to mitigate the critical risk posed by this vulnerability.