Severe 9.5 UEFI Flaw Leaves Global Servers Open to Remote Hijack

How an accidental pull request blew the embargo

A coordinated disclosure plan fell apart when a motherboard vendor inadvertently published the fix in a public repository.

The vulnerability was unearthed by Alex Matrosov of Anthropic and Dan Holmes of Google within TianoCore EDK II, the open-source foundational framework used across the industry to build UEFI firmware. The original researchers had intended to keep the bug under wraps until January 2027 to give server vendors time to ship updates.

That plan collapsed when firmware builder AMI submitted a public pull request that simultaneously detailed the root cause and published the fix code. With the cat out of the bag, the TianoCore Project published its own advisory, and threat actors were handed the blueprint for reverse engineering an exploit.

This is not the first supply chain headache to strike infrastructure recently; enterprise networks are still scrambling to handle the Brotli flaw in web servers following similar disclosure snags.

The anatomy of the EDK II buffer overflow

Tracked as CVE-2026-97631, the National Vulnerability Database classifies the bug as an out-of-bounds write and classic buffer overflow triggered by an incorrect calculation of buffer size during remote access. Exploiting it yields arbitrary code execution before the host operating system even initialises.

That boot-level positioning is what makes a UEFI firmware flaw terrifying to security teams. If an adversary compromises the pre-boot environment, traditional antivirus agents and endpoint detection suites running inside Windows or Linux are completely blind to it.

Reimaging the machine does nothing. Swapping out the NVMe drives does nothing. The compromise lives in the motherboard SPI flash memory itself.

There is a modest silver lining: pulling off an exploit is not trivial. An attacker generally requires some level of existing network foothold or access to reach the targeted interface, which means state-sponsored groups and sophisticated syndicates will likely weaponise it first rather than opportunists looking for single-click compromises.

The long, painful road to firmware remediation

Fixing upstream code in an open-source project is simple; pushing that fix to millions of operational motherboards in enterprise server racks is an operational nightmare. Hardware makers take months to adapt EDK II patches to their bespoke board packages, after which system administrators must schedule dreaded production downtime to flash firmware.

Given the fragmented hardware ecosystem, many legacy and unmanaged servers will likely never receive the update, remaining permanently vulnerable behind perimeter firewalls.

Availability and remediation timeline

The upstream patch code for EDK II is currently available via the TianoCore repository, but end users cannot simply download it and protect their hardware. Enterprise operators across North America and Europe must wait for their specific server vendors—such as Dell, HPE, Supermicro, and Lenovo—to integrate the patch into proprietary BIOS updates.

IT administrators should identify external-facing baseboard management and server hardware immediately, segment server management interfaces from public networks, and track OEM support portals for microcode updates arriving throughout late 2026.

With upstream patches now public, the clock is running against defenders. Until hardware manufacturers ship tested motherboard packages, the primary defence remains strict network isolation around out-of-band management and server interfaces.