Researchers uncover severe firmware flaw threatening global data centers before early disclosure

Cybersecurity researchers Alex Matrosov of Anthropic and Dan Holmes of Google have discovered a critical-severity vulnerability in the open source TianoCore EDK II codebase used to build UEFI firmware for modern servers. Tracked as CVE-2026-97631 with a severity score of 9.5 out of 10, the flaw affects an ICMP component and can allow remote arbitrary code execution during the boot sequence. While it does not appear to have been exploited in the wild yet, the bug impacts foundational firmware widely adopted across cloud providers, server vendors, and independent BIOS makers like AMI, Insyde, and Phoenix, as well as Microsoft's Project Mu fork. [2][3]

The vulnerability involves a buffer overflow in BIOS firmware that executes before the operating system and protections like Secure Boot or anti-malware can activate. Although payloads delivered directly by the flaw run only once and lack persistence, they provide attackers with an opening to install additional software that runs early in every boot process. Remediating such compromises is especially difficult, as reinstalling the operating system or swapping storage drives will not remove the malicious code. [2][3]

The researchers originally planned to keep the vulnerability private until a coordinated disclosure in January 2027. However, motherboard and firmware maker AMI published a pull request detailing the issue alongside a fix, prompting the TianoCore Project to issue a public advisory prematurely. Because downstream hardware vendors must individually patch and distribute firmware updates across fragmented ecosystems, security specialists warn the public release of the patch code may give advanced threat actors an advantage before organizations can deploy defenses. [2]