Code-execution flaw in UEFI firmware impacts most servers on planet Earth

CVE-2026-97631 doesn’t have an effect on residence and small workplace customers, or every other customers who boot their units solely from disk drives. As an alternative, it applies solely to organizations with machines that boot from native networks, or conceivably from Web-connected assets. Even then, the focused firmware should depend on EDK2, versus a distinct reference implementation, and use the PXE performance (which is turned on by default).

In an electronic mail, Intel stated that none of its “industrial merchandise presently underneath safety assist” are identified to be affected. “Intel doesn’t embrace the affected EDK2 performance in its reference code, although it might be built-in by an OEM board vendor or system producer,” the corporate added. It suggested prospects to examine with their system producer for particular steerage. Publicly obtainable Intel reference code, nevertheless, makes reference to EDK2. Additional, TianoCore has stated that every Intel-supplied UEFI improvement package “is a completely validated implementation… for a selected revision of the EDK II supply.” Many different Intel paperwork reference EDK2 as nicely.

Arm, in the meantime, responded to a listing of questions with: “CVE-2026-97631 will not be straight relevant to Arm’s product portfolio.” Like Intel, firmware the corporate makes obtainable additionally borrows closely from EDK2. TianoCore has additionally documented Arm’s reliance on EDK2.

Whereas it’s potential some platforms are freed from EDK2 code, it’s prudent for customers of all servers to analyze if CVE-2026-97631 impacts them.

Questions despatched to AMD, Phoenix Applied sciences, AMI, Microsoft, and Amazon—probably a number of the different greatest organizations affected—went unanswered when this put up went stay. With out concrete solutions to questions on the usage of EDK2 by organizations like these, it’s unimaginable to say what or how units are affected and what actions, if any, these organizations, or their customers, ought to take. Representatives from the TianoCore Venture additionally didn’t reply.