A critical firmware bug can run attacker code before Windows or any other operating system starts. The flaw is tracked as CVE-2026-97631. CVE is the public ID system for security bugs. TianoCore rated it 9.5 under CVSS version 4. It lives in the Preboot Execution Environment (PXE) network-boot driver inside TianoCore's EDK II open-source UEFI firmware base. Many PC and server makers build their BIOS or UEFI firmware on that code.
Researchers showed that while a machine is PXE-booting over IPv4 or IPv6, an unauthenticated attacker who can deliver Internet Control Message Protocol (ICMP) error packets to it can overflow a fixed buffer in the PXE driver. That corruption happens in the early firmware phase, before Secure Boot or measured boot has checked any operating-system component. Outcomes range from a hung boot to arbitrary code running with full early-boot privileges when the attacker knows the target firmware build.
A fix landed in EDK II's master branch on October 15, 2026, through pull request 13302. It isn't in a stable EDK II release yet. Firmware vendors still have to fold the change into their own BIOS or UEFI updates and ship them. As of our check, major PC and server makers hadn't posted clear product advisories for this CVE. No in-the-wild exploitation has been reported. Public lab proof-of-concept code has appeared, which raises the urgency of the practical steps below.
For East Texas businesses the response is straightforward. Inventory which PCs and servers still allow network boot. Turn off PXE or the UEFI network stack in firmware setup wherever you don't need it. Keep machines that do image or recover over the network on a segmented provisioning VLAN away from guest and day-to-day user traffic. Watch your PC and server maker for a BIOS or UEFI update that cites CVE-2026-97631, then apply it on a planned reboot. We covered a similar firmware-update habit when Dell PowerEdge servers needed a critical system fix.
Canton firms that want a practical review of boot settings, firmware status, and network segmentation can ask My I.T. Consultants for a Free Assessment. Call 903-675-5431 Monday through Friday, 7:00 a.m. to 6:00 p.m. Contract clients get 24/7 coverage across East Texas.
Want help with this at your business? See Cybersecurity on our Services page or contact My I.T. Consultants.
