A critical vulnerability identified as CVE-2026-97631 poses a significant risk to servers utilizing UEFI firmware that relies on EDK2 and PXE functionality. This flaw primarily affects organizations that boot their machines from local networks or Internet-connected resources, rather than home users or those booting solely from disk drives. The vulnerability has raised concerns among cybersecurity professionals, as it could potentially expose a vast number of servers globally to exploitation.
Intel has stated that none of its commercial products currently under security support are known to be affected by this vulnerability. The company clarified that while it does not include the vulnerable EDK2 functionality in its reference code, it may still be integrated by OEM board vendors or system manufacturers. Users are advised to consult their specific system manufacturers for guidance. However, publicly available Intel reference code does reference EDK2, indicating that some systems may still be at risk.
Arm has also indicated that CVE-2026-97631 is not directly applicable to its product portfolio, although its firmware heavily borrows from EDK2. This reliance on EDK2 raises questions about the potential impact on Arm-based systems, as TianoCore documentation confirms Arm’s connection to EDK2.
Despite these reassurances from major manufacturers, the lack of responses from other key players, including AMD, Microsoft, and Amazon, leaves uncertainty regarding the extent of the vulnerability’s impact. As organizations await further clarification, it is advisable for all server users to investigate whether their systems are affected by CVE-2026-97631.
For more detailed information on the implications of this vulnerability, refer to Ars Technica.
