Most data centers and servers on the planet could be vulnerable to a dangerous UEFI firmware flaw – here’s what we know
follow us
Add us as a preferred source on Google
- Researchers discover critical flaw in UEFI firmware that could allow remote code execution on servers
- Publicly releasing patch code can speed up exploit development before many vendors deploy updates
- Delay in applying firmware patches to hardware ecosystems leaves organizations exposed despite available fixes
Cybersecurity researchers at Anthropic and Google have discovered a critical vulnerability in the boot firmware used by virtually all servers in existence today.
A patch is available, but given the fragmented market for UEFI manufacturers, it could be months before most servers are protected. Meanwhile, the patch code has been made public, meaning cybercriminals will have their work cut out for them.
Discovering the error
Virtually all modern servers today run UEFI (Unified Extensible Firmware Interface), software built into the server’s motherboard that helps boot the device and load the operating system. It includes security features such as Secure Boot, which helps stop unauthorized programs from running when the machine starts.
Latest videos ofTechnologyRadar
The free and open source toolset that developers use to create this firmware is called TianoCore EDK II and serves as a common foundation for creating UEFI firmware for different types of hardware.
Anthropic’s Alex Matrosov and Google’s Dan Holmes recently discovered that EDK II contained a critical buffer overflow vulnerability. The National Vulnerability Database (NVD) describes it as a bug in the BIOS “where a user can cause “out-of-bounds writing”, classic buffer overflow, and “incorrect buffer size calculation” via remote access.” “Successful exploitation of this flaw can result in remote execution of arbitrary code,” he added.
Like other UEFI vulnerability exploits, this one would be difficult to remediate in the wild. Deploying malicious code before security solutions, or even the operating system, means that any anti-malware or endpoint protection solutions installed will not be able to detect or remove it. Reinstalling the operating system will not help, nor will replacing the hard drive.
The bug is now tracked as CVE-2026-97631 and has been assigned a severity score of 9.5/10 (critical). Luckily, it does not appear to have been exploited in the wild. However, that could change very soon, as the security community failed in outreach efforts.
Various companies and hardware manufacturers develop their own UEFI and many rely on shared codebases such as EDK II. When a vulnerability is discovered in the code, fixing it upstream (in the codebase) is only half the battle: each affected firmware vendor must patch its own product and then distribute the new firmware to its customers. This process can take time, leaving a window between the availability of the solution and its deployment to affected systems.
Discretion is recommended
That’s why discretion is paramount, and some participants seem to have dropped the ball, with Ars Technique stating that the two researchers who found the bug arranged for it to be kept private until a coordinated disclosure planned for January 2027.
However, AMI, one of the motherboard manufacturers, apparently published a pull request last month that not only detailed the vulnerability but also included a fix for the code.
Since the cat was out of the bag, Project TianoCore members also posted a public notice about the flaws.
“With patch code publicly available, it will be trivial for advanced hackers to learn how the vulnerability is triggered and create working exploits,” writes Ars Technica’s Dan Goodin. “To further compound the urgency, patching UEFI code vulnerabilities in millions of end devices sold and used by thousands of hardware manufacturers and cloud providers is cumbersome and time-consuming.”
However, exploiting this flaw is not so easy. Threat actors must have some level of access to the target device beforehand, meaning the bug will primarily be used by state-sponsored threat actors and large, highly organized hacker collectives.
It’s really turning out to be a Black October, especially since PHP2Shell’s flaws were inadvertently revealed to the public in a similar way.
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment