Critical UEFI Firmware Flaw: CVE-2026-97631 Threatens Global Data Centres

Cybersecurity researchers have discovered CVE-2026-97631, a critical-severity vulnerability in the open-source TianoCore EDK II codebase used to build UEFI firmware for modern servers. The flaw has a severity score of 9.5 out of 10 and can allow remote arbitrary code execution during the boot sequence.

The vulnerability affects foundational firmware widely adopted across cloud providers, server vendors, and independent BIOS makers, including AMI, Insyde, and Phoenix, as well as Microsoft’s Project Mu fork.

What is CVE-2026-97631?

CVE-2026-97631 is a critical vulnerability in the ICMP component of the TianoCore EDK II codebase. It can allow remote arbitrary code execution during the boot sequence.

Key facts:

Attribute	Details
CVE ID	CVE-2026-97631
Severity	9.5 out of 10 (Critical)
Affected component	ICMP in TianoCore EDK II
Impact	Remote arbitrary code execution during boot
Exploited in wild	Not yet, as of disclosure
Affected vendors	AMI, Insyde, Phoenix, Microsoft Project Mu

Who discovered it?

The vulnerability was discovered by cybersecurity researchers Alex Matrosov of Anthropic and Dan Holmes of Google.

The researchers identified the flaw in the open-source TianoCore EDK II codebase, which is used to build UEFI firmware for modern servers worldwide.

Who is affected?

The flaw affects foundational firmware widely adopted across:

Cloud providers
Server vendors
Independent BIOS makers, including AMI, Insyde, and Phoenix
Microsoft’s Project Mu fork

Because TianoCore EDK II is used to build UEFI firmware for modern servers, the potential impact spans much of the global data centre infrastructure.

What is UEFI firmware?

UEFI (Unified Extensible Firmware Interface) is the low-level firmware that initializes hardware during the boot process before the operating system loads.

UEFI firmware:

Starts the computer or server
Initializes hardware components
Loads the operating system
Provides security features like Secure Boot
Manages system settings and diagnostics

A vulnerability in UEFI firmware is particularly dangerous because it operates below the operating system level, making it harder to detect and remediate with traditional security tools.

Why is this flaw so serious?

CVE-2026-97631 is serious for several reasons:

1. Remote code execution during boot

An attacker could potentially execute arbitrary code during the boot sequence, before the operating system and its security tools are even loaded.

2. Critical severity score

At 9.5 out of 10, this is classified as a critical vulnerability, indicating maximum potential impact.

3. Wide adoption

TianoCore EDK II is used by major BIOS vendors and cloud providers, meaning the potential blast radius is enormous.

4. Firmware-level persistence

Firmware-level attacks are extremely difficult to detect and remove, as they persist even after operating system reinstalls.

Has it been exploited?

As of disclosure, the flaw does not appear to have been exploited in the wild yet.

However, security researchers and vendors are urging organisations to patch quickly, as proof-of-concept exploits and active scanning often follow public disclosure of critical vulnerabilities.

What should organisations do?

Immediate actions

Identify servers using TianoCore EDK II-based firmware
Check with your server vendor for patched firmware
Apply firmware updates as soon as they are available
Monitor vendor advisories from AMI, Insyde, Phoenix, and Microsoft
Review network segmentation to limit exposure
Ensure ICMP traffic to management interfaces is restricted

Longer-term actions

Establish a firmware patching programme
Include firmware in vulnerability management
Use hardware root of trust where available
Monitor for boot-level anomalies
Work with vendors on coordinated disclosure
Test firmware updates in staging environments first

Vendor response

Affected vendors including AMI, Insyde, Phoenix, and Microsoft are expected to release patched firmware based on the TianoCore EDK II fix.

Organisations should monitor:

AMI security advisories
Insyde security advisories
Phoenix security advisories
Microsoft Project Mu updates
TianoCore project announcements

Why firmware security matters more than ever

Firmware attacks are among the most dangerous because they:

Operate below the operating system
Persist across OS reinstalls
Are difficult to detect with standard antivirus
Can compromise entire server fleets
Affect cloud infrastructure at scale

The discovery of CVE-2026-97631 highlights the need for organisations to treat firmware as a first-class security concern, not an afterthought.

Comparison with other recent firmware threats

Threat	Type	Severity	Status
CVE-2026-97631	UEFI firmware (TianoCore EDK II)	9.5/10 Critical	Not yet exploited
CVE-2026-97229	GitLab remote code execution	Maximum severity	Actively exploited
CVE-2026-111497	Brotli compression library	Critical	Actively exploited
CVE-2026-101767	Oracle E-Business Suite	Critical	Actively probed

What happens next?

Vendors will release patched firmware
Organisations will begin patching cycles
Researchers may publish proof-of-concept exploits
CISA may add the CVE to its Known Exploited Vulnerabilities catalog if exploitation begins
Cloud providers will roll out firmware updates across their fleets

This is a developing story. Global IT Services will update this article as vendor patches and new technical details emerge.

Frequently Asked Questions

What is CVE-2026-97631?

CVE-2026-97631 is a critical vulnerability in the TianoCore EDK II codebase used to build UEFI firmware for modern servers, with a severity score of 9.5 out of 10.

How severe is CVE-2026-97631?

It is rated 9.5 out of 10 (Critical) and can allow remote arbitrary code execution during the boot sequence.

Who discovered CVE-2026-97631?

The flaw was discovered by Alex Matrosov of Anthropic and Dan Holmes of Google.

Which vendors are affected?

The flaw affects firmware built on TianoCore EDK II, used by AMI, Insyde, Phoenix, Microsoft Project Mu, and many cloud providers and server vendors.

Has CVE-2026-97631 been exploited?

As of disclosure, the flaw does not appear to have been exploited in the wild yet.

How can I protect my servers?

Identify affected firmware, apply vendor patches as soon as available, restrict ICMP traffic to management interfaces, and include firmware in your vulnerability management programme.

Critical UEFI Firmware Flaw: CVE-2026-97631 Threatens Global Data Centres

What is CVE-2026-97631?

Who discovered it?

Who is affected?

What is UEFI firmware?

Why is this flaw so serious?

1. Remote code execution during boot

2. Critical severity score

3. Wide adoption

4. Firmware-level persistence

Has it been exploited?

What should organisations do?

Immediate actions

Longer-term actions

Vendor response

Why firmware security matters more than ever

Comparison with other recent firmware threats

What happens next?

Frequently Asked Questions

What is CVE-2026-97631?

How severe is CVE-2026-97631?

Who discovered CVE-2026-97631?

Which vendors are affected?

Has CVE-2026-97631 been exploited?

How can I protect my servers?

Sources

cve-2026-97631

Critical UEFI Firmware Flaw: CVE-2026-97631 Threatens Global Data Centres