CVE-2026-97631 lets attackers act before Windows, Linux
Google and Anthropic researchers found a 9.5-rated flaw in TianoCore EDK II that can run malicious code before Windows or Linux loads on network-booted servers.
CVE-2026-97631 is a 16-year-old flaw in TianoCore EDK II boot software, rated 9.5 out of 10.
Researchers Alex Matrosov of Anthropic and Dan Holmes of Google say it can run malicious code before Windows or Linux starts.
The risk centres on network booting used by businesses and data centres, not ordinary home PCs that boot from internal drives.
AMI published details early; the TianoCore Project issued a public advisory on 22 October 2026.
Experts advise checking firmware with manufacturers and disabling network boot if it is not needed.