Code-execution flaw in UEFI firmware impacts most servers on planet Earth

CVE-2026-97631 doesn’t have an effect on dwelling and small workplace customers, or another customers who boot their gadgets solely from disk drives. Instead, it applies solely to organizations with machines that boot from native networks, or conceivably from Internet-connected assets. Even then, the focused firmware should depend on EDK2, versus a unique reference implementation, and use the PXE performance (which is turned on by default).

In an e mail, Intel mentioned that none of its “industrial merchandise presently beneath safety help” are recognized to be affected. “Intel doesn’t embody the affected EDK2 performance in its reference code, although it might be built-in by an OEM board vendor or system producer,” the corporate added. It suggested prospects to test with their system producer for particular steering. Publicly obtainable Intel reference code, nevertheless, makes reference to EDK2. Further, TianoCore has said that every Intel-supplied UEFI improvement equipment “is a totally validated implementation… for a selected revision of the EDK II supply.” Many different Intel paperwork reference EDK2 as nicely.

Arm, in the meantime, responded to an inventory of questions with: “CVE-2026-97631 just isn’t straight relevant to Arm’s product portfolio.” Like Intel, firmware the corporate makes obtainable additionally borrows closely from EDK2. TianoCore has additionally documented Arm’s reliance on EDK2.

While it’s doable some platforms are freed from EDK2 code, it’s prudent for customers of all servers to analyze if CVE-2026-97631 impacts them.

Questions despatched to AMD, Phoenix Technologies, AMI, Microsoft, and Amazon—seemingly a number of the different largest organizations affected—went unanswered when this put up went reside. Without concrete solutions to questions on using EDK2 by organizations like these, it’s not possible to say what or how gadgets are affected and what actions, if any, these organizations, or their customers, ought to take. Representatives from the TianoCore Project additionally didn’t reply.