16‑Year UEFI Firmware Flaw Lets Attackers Bypass Secure Boot Over Local Networks
A 16‑year‑old bug in widely used EDK II UEFI firmware, tracked as CVE‑2026‑97631, allows attackers on the local network to run code before Secure Boot checks during PXE network boot, and there is still no patched stable EDK II release.
A long‑standing weakness in the low‑level code that starts many modern computers is forcing defenders to reassess how secure their systems really are. Researchers have disclosed CVE‑2026‑97631, a critical vulnerability in EDK II, a widely used open‑source implementation of UEFI firmware. The flaw allows code execution before Secure Boot runs its checks when a machine starts over the network using PXE.
According to technical write‑ups, the bug has been present for around 16 years and affects systems that permit PXE network boot. An attacker with access to the local network who can interact with a vulnerable system’s PXE process may be able to inject malicious code into the boot sequence at a stage many organisations assume is protected by Secure Boot. There is currently no patched stable EDK II release that fixes the issue, leaving vendors and administrators waiting on updates and leaning on interim mitigations.
For users, pre‑boot exploitation sounds far removed from daily work, but the outcomes are very concrete. If attackers can hijack the firmware that initialises a computer, they can install implants that survive operating system reinstalls, dodge many antivirus tools and provide persistent, hard‑to‑remove access to machines deep inside government networks, corporate offices or cloud infrastructure.
The immediate exposure is greatest in environments that rely heavily on PXE boot: enterprise fleets, data centres, universities and some public‑sector IT estates. In these settings, administrators often use network boot to deploy or repair systems at scale. An adversary who has already found a way onto the local network — via phishing, misconfigured equipment or an insider — could combine that access with CVE‑2026‑97631 to plant malicious firmware‑level payloads on many devices.
This matters for national security because UEFI Secure Boot is treated as part of the root of trust for modern computing. Defence, intelligence and critical infrastructure operators have invested in locking down applications and operating systems based on the assumption that firmware enforcing Secure Boot was relatively robust. A vulnerability that allows attackers to run their own code first undermines that assumption.
States with advanced offensive cyber programmes will see the value of such a capability. A reliable way to gain low‑level access to target networks is prized in espionage, and the fact that this bug has existed for well over a decade naturally raises questions about whether sophisticated actors may already have found and used it. Public reporting doesn’t answer that, but the opportunity fits known offensive priorities.
Control of a machine before it loads an operating system means most higher‑level security checks never get a chance to run. Over the coming weeks, key signals will be advisories from major computer and server manufacturers, updates from cloud providers on any impact to their bare‑metal services, and guidance from national cyber agencies on detection and temporary workarounds. How quickly those responses arrive will determine whether CVE‑2026‑97631 stays a hard‑to‑exploit edge case for most users or becomes a common entry point in real‑world attacks.
Sources
- OSINT