CVE-2026-97631 Firmware Vulnerability Impacts Network-Boot Servers Utilizing EDK2
CVE-2026-97631 is a newly disclosed firmware vulnerability that specifically threatens organizations operating machines configured to boot from local networks or internet-connected resources using the EDK2 reference implementation.
The security flaw relies on the Preboot Execution Environment (PXE) functionality within EDK2 firmware, which remains enabled by default on vulnerable systems. While standard desktop hardware remains safe from this specific vector, enterprise servers and data center infrastructure utilizing network boot configurations face potential exposure if their board vendors integrated the affected codebase.
Manufacturer Responses and EDK2 Code Integration
Hardware vendors have issued varying assessments regarding their exposure to the vulnerability. Intel stated in an email that none of its commercial products currently under security support are known to be affected. The company noted that it does not include the affected EDK2 functionality directly in its base reference code, though system manufacturers or OEM board vendors may integrate it independently. Publicly available Intel reference code does contain mentions of EDK2, and TianoCore maintains that each Intel-supplied UEFI development kit represents a fully validated implementation for specific revisions of the EDK II source.
Arm reported that CVE-2026-97631 is not directly applicable to its core product portfolio. However, firmware provided by Arm borrows heavily from EDK2, and TianoCore documentation explicitly acknowledges Arm’s reliance on the codebase. Meanwhile, inquiries sent to AMD, Phoenix Technologies, AMI, Microsoft, and Amazon regarding their use of EDK2 went unanswered by the time of publication.
Identifies Devices Vulnerable to CVE-2026-97631
Which devices are directly vulnerable to CVE-2026-97631?
The vulnerability exclusively targets organization-owned machines that boot from local networks or internet resources using firmware that relies on the EDK2 reference implementation with PXE functionality enabled by default.
Are standard home computers and laptops affected?
No. Home users, small office setups, and any users who boot their devices solely from local disk drives are entirely unaffected by this vulnerability.
What steps should system administrators take now?
Administrators should investigate their server fleets to determine whether their specific platform firmware incorporates EDK2 code and consult their system manufacturers for targeted guidance and patches.
Worth a look