A critical remote code execution vulnerability in UEFI firmware has surfaced, and the scope is alarming. The vulnerability is CVE-2026-97631, disclosed by TianoCore on 22 October 2026 and rated 9.5 critical under CVSS 4.0 (advisory GHSA-99cj-7hg9-mp4m). It is an out of bounds write in the PXE network boot driver, NetworkPkg/UefiPxeBcDxe, in EDK II, the open source reference firmware that most vendor UEFI builds derive from. It was reported by Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google, the vulnerable code dates to a November 2010 commit, and it affects EDK II up to and including edk2-stable202608. Because the bug sits in shared upstream code rather than one vendor's fork, it affects firmware used across a broad range of server hardware, meaning the machines running your Proxmox cluster, your NAS, or your bare-metal Docker hosts could be sitting on a compromised foundation before the OS even boots. UEFI attacks are particularly nasty because they can survive a full OS reinstall and bypass most endpoint security tools entirely.

This post is about what you can actually do about it if you run self-hosted infrastructure. Be clear up front that as of 29 October 2026 there is no fixed stable EDK II release. The fix landed on the main development branch as PR 13302 on 15 October, the TianoCore advisory still lists the issue as not patched, and Red Hat, SUSE and Debian all list their edk2 packages as affected with no fix available. Microsoft's Project Mu tagged builds containing the fix on 26 October, but most people are waiting on their firmware vendor. That makes the configuration hardening below the actual mitigation for now, not an optional extra on top of patching.

💡 Why UEFI Vulnerabilities Are Especially Serious

UEFI firmware runs before your bootloader, before your kernel, before any security software you have installed. A successful exploit at this layer can plant a bootkit that persists across reboots, re-infections, and even drive replacements. Code execution at the firmware level means an attacker has a foothold that is effectively invisible to anything running inside the OS.

For self-hosters, the threat model here is specific rather than vague. CVE-2026-97631 is triggered by an unauthenticated attacker delivering a crafted unicast ICMP error message to the machine during the PXE boot window, so it only matters on machines that actually attempt PXE network boot. PXE is enabled in EDK II's default build. Red Hat and SUSE assess realistic exploitation as coming from an adjacent network position or an existing foothold on your LAN rather than from the open internet, and the flaw is not by itself a way into your network. The highest value mitigation is therefore to disable PXE boot on every machine that does not need it, covered in Step 3 below. If you only read one step, read that one.

🧰 Prerequisites

  • Physical or remote (IPMI/iDRAC/iLO) access to your servers
  • Vendor credentials to check for firmware updates (Dell, Supermicro, ASRock Rack, etc.)
  • A maintenance window, because UEFI updates require reboots
  • Backup of any critical UEFI settings (boot order, RAID config, etc.)

🔄 Step 1: Check Your Firmware Version

Before anything else, know what firmware version is running on every machine. On Linux you can pull this without a reboot:

sudo dmidecode -s bios-version sudo dmidecode -s bios-release-date

For a broader system summary including board and firmware details:

sudo dmidecode -t bios

Take note of the vendor, board model, and current version. You will need these to cross-reference against your vendor's security advisories. Check your vendor's support portal directly, as each vendor publishes their own CVE response pages. Dell uses the DSA advisory system, Supermicro posts to their security advisories page, and ASRock Rack maintains a product security page. Search those portals for CVE-2026-97631 specifically, and compare versions. Expect to find nothing: at the time of writing almost no OEM has published an applicability statement, because there is no fixed upstream EDK II release for them to pick up yet.

⬆️ Step 2: Apply Firmware Updates

Most server vendors ship firmware update tools that can run from within Linux. For example, Dell's iDRAC-connected servers can use the racadm tool or the Repository Manager. Supermicro provides an SMCIPMItool and in-band update utilities. Check your vendor's official documentation for the exact command, because the flags and file formats differ between platforms and versions and guessing wrong here can brick a board.

A safe general approach for servers with a BMC or IPMI interface is to stage the update through the out-of-band interface, which lets you recover if something goes wrong. If you are updating via in-band Linux tools, always have a console session ready, either physical or via IPMI SOL:

# Example: open a Serial Over LAN console via ipmitool before updating ipmitool -I lanplus -H [bmc-ip] -U [username] -P [password] sol activate

After the update, verify the new version with dmidecode again and confirm the machine boots cleanly before moving to the next host.

🛡️ Step 3: Lock Down the UEFI Attack Surface

Patching is the most important step, but hardening the firmware configuration independently reduces your exposure and limits what an attacker can do even if a future flaw appears. Work through these settings in your UEFI setup or via your BMC interface:

  • Set a strong UEFI administrator password. This blocks unauthorized changes to boot settings and Secure Boot configuration. Use a long random string and store it in your password manager.
  • Enable Secure Boot, but do not count on it here. On servers running standard Linux distributions, Secure Boot with the distro's signed bootloader is straightforward to enable, and it prevents unsigned or tampered boot code from executing. It does not mitigate CVE-2026-97631. The TianoCore advisory is explicit that exploitation happens before Secure Boot or measured boot has verified or measured any OS component, so the attacker is already executing by the time those checks would run. Enable it for general hygiene, not as a fix for this bug.
  • Disable network boot (PXE). This is the mitigation for CVE-2026-97631. Remove PXE from the boot order, and disable the UEFI network stack or the PXE option ROM outright if your firmware exposes that setting, on every machine that does not need to net boot. The vulnerable code is the PXE base code driver itself, so a machine that never brings up the PXE stack is not exposed by this path. The TianoCore advisory lists no other workaround. If you do rely on PXE for provisioning, keep it on an isolated VLAN that untrusted hosts cannot reach, and only enable it during a provisioning window.
  • Disable unused firmware features. USB ports, legacy BIOS compatibility (CSM), and unused PCIe slots all expand the firmware attack surface. Disable anything you do not use.
  • Enable firmware write protection where available. Some boards offer a physical write-protect jumper or a firmware setting that prevents the UEFI flash from being written while the system is running. Check your board's manual.

🔒 Step 4: Isolate BMC and IPMI Interfaces

IPMI, iDRAC, iLO, and similar out-of-band management interfaces have their own network stacks and their own long history of vulnerabilities. If yours are reachable from your general LAN or, worse, from the internet, that is an urgent problem to fix regardless of this specific flaw.

Put all BMC interfaces on a dedicated management VLAN with strict firewall rules. Only your management machine should be able to reach them:

# Example: block all BMC traffic except from your management host # Add this to your firewall ruleset (iptables, nftables, or your router ACL) # Replace [mgmt-host-ip] and [bmc-subnet] with your actual values # Use -A (append) so the rules end up in the order written. # With -I (insert at the top) the DROP would land ahead of the # ACCEPT and lock out your management host too. # Allow management host to reach BMC subnet iptables -A FORWARD -s [mgmt-host-ip] -d [bmc-subnet]/24 -j ACCEPT # Drop everything else to BMC subnet iptables -A FORWARD -d [bmc-subnet]/24 -j DROP

If your switch supports it, assign BMC ports to a dedicated VLAN at the hardware level so isolation is enforced even if your firewall rules are misconfigured.

📋 Step 5: Inventory and Monitor Going Forward

A one-time patch run is not enough. UEFI vulnerabilities will keep appearing. Build a lightweight process to stay ahead of them:

  • Keep a spreadsheet or a simple text file listing every server, its board model, and the current firmware version.
  • Subscribe to the security advisory mailing lists or RSS feeds for your hardware vendors.
  • Add a quarterly firmware review task to your maintenance calendar.
  • If you run Proxmox, note that its own repositories (pve-enterprise and pve-no-subscription) ship the hypervisor, not a firmware audit suite, so there is no official Proxmox tooling that will check this for you. Do the firmware audit manually.

For larger homelab setups, tools like Netdata or Checkmk can alert on IPMI sensor anomalies, which will not catch firmware tampering directly but can surface hardware-level weirdness that warrants investigation.

🔧 Troubleshooting

Server will not POST after firmware update: Use the BMC's virtual console to catch early boot output. Many boards have a dual-BIOS or firmware recovery mode triggered by a jumper or a key combination at power-on. Check your board manual for the recovery procedure before you start.

Secure Boot breaks your boot loader: You likely need to enroll your distro's signing keys. On Debian and Ubuntu-based systems, the shim package handles this automatically for standard kernels. Custom kernels or out-of-tree drivers will need manual key enrollment with mokutil. See your distro's Secure Boot documentation for the exact steps.

Cannot find a firmware update for your board: This is the normal case for CVE-2026-97631 right now, because no fixed stable EDK II release exists for OEMs to rebase onto. Most OEM firmware is a rebranded Insyde, AMI or Phoenix build derived from EDK II, so track the upstream TianoCore advisory GHSA-99cj-7hg9-mp4m and your silicon vendor's bulletins alongside your OEM's. Note that an AMI engineer signed off a public EDK II pull request on 28 September that described this flaw by CVE number and included the fix, weeks before the coordinated disclosure date, which is part of why the advisory came out early. Monitor and follow up directly with the OEM's support channel.

✅ Wrap Up

UEFI vulnerabilities sit at the worst possible layer of the stack: below everything you normally rely on to detect or contain a compromise. For CVE-2026-97631 specifically there is no firmware patch to apply yet, so configuration hardening is the mitigation rather than a supplement to it. Disable PXE boot where you do not need it, lock down the rest of the firmware configuration, isolate your management interfaces, and build a process to pick up the firmware update when your vendor finally ships it.

If you only do one thing today, disable PXE boot on every server that does not need to net boot, because that is what actually closes off CVE-2026-97631 while you wait for firmware. Pulling your firmware versions with dmidecode is still worth doing, but right now it mostly tells you that no fix is available. Everything else in this post builds on knowing where you actually stand. Your self-hosted infrastructure is worth protecting at every layer, not just the ones you can see from inside the OS.

Originally published at codewithromi.com.