What happened
Defenders worldwide are dealing with a code-execution vulnerability in boot-time firmware, this time in a codebase used by most server vendors and data centers. The flaw carries a severity rating of 9.5 out of 10 and is tracked as CVE-2026-97631.
Where it lives
The issue sits in an ICMP component of TianoCore EDK II, the open source codebase hardware makers and cloud providers use to build UEFI firmware. A UEFI Forum representative last year called EDK2 the "preeminent solution / implementation of the UEFI specifications." Virtually all UEFI suppliers, including AMI, Insyde and Phoenix, use the reference code extensively, and Microsoft's hardened EDK2 fork Project Mu also used the vulnerable component.
Why the risk is high
The flaw is a memory-corruption issue that attackers can exploit to execute malicious code before the operating system and defenses such as Secure Boot take effect. Secure Boot establishes a chain of trust for all code loaded during boot, including the Trusted Platform Module. The initial payload delivered through the flaw has no persistence and runs only once, but it can open a wide door for installing other payloads that run early in every boot sequence.
What to watch
Organizations running servers and data centers should closely track patches from their UEFI suppliers. Because the flaw sits at the bottom of the boot chain, conventional OS-level security tools may not detect such attacks.
