A critical vulnerability in UEFI firmware dating back 16 years has been discovered that enables attackers to execute malicious code during server startup. Tracked as CVE-2026-97631, the flaw exists in the network boot feature and can be triggered through specially crafted oversized error messages that overwrite memory regions.
The vulnerability specifically affects servers that support network-based initialization. Servers that boot exclusively from storage devices are not impacted by this issue. To protect your infrastructure, consult your firmware manufacturer for patches and consider disabling network boot if it isn't essential for your operations.