Security researchers from Google and Anthropic have discovered a serious security flaw in software widely used by server manufacturers and data centers worldwide.
The vulnerability, identified as CVE-2026-97631, is 16 years old and has received a severity rating of 9.5 out of 10.
It could allow hackers to run malicious software before a computer’s operating system starts, potentially giving them access to sensitive information and important system controls.
The flaw affects TianoCore EDK II, software used to help computers start up. Major firmware manufacturers, including AMI, Insyde, and Phoenix, use this software. Microsoft’s Project Mu has also included the affected code.
How Hackers Could Exploit the Flaw
The vulnerability affects computers and servers that can start using files downloaded from a network instead of their own storage drives.
This feature, called network booting, is commonly used by businesses and data centers to manage large numbers of computers.
Researchers discovered that the affected software does not properly check the size of certain network messages.
Hackers could send a specially prepared message containing more data than the software can safely handle.
This could cause the computer to freeze during startup or allow attackers to run malicious code. The problem affects both IPv4 and IPv6 network connections.
Hackers Could Bypass Important Security Protections
The biggest concern is that attackers could exploit the vulnerability before the computer’s operating system and its security protections are fully active.
This could give hackers high-level control over an affected device.
Security expert HD Moore warned that attackers could potentially access sensitive security components and compromise disk encryption under certain conditions.
Hackers might also use the vulnerability to install malware that remains on the system after a restart.
However, attackers would generally need access to the target’s network, and their attacks would need to be adjusted for different hardware and software versions.
There is currently no evidence that the flaw allows attackers to break into a protected network from the outside.
Security Flaw Was Revealed Earlier Than Planned
The vulnerability was discovered by Alex Matrosov of Anthropic and Dan Holmes of Google.
The researchers originally planned to publicly disclose the issue in January, giving manufacturers time to prepare security updates.
However, hardware manufacturer AMI published information about the vulnerability and a proposed fix ahead of schedule.
Following this, the TianoCore Project released a public security advisory on October 22, 2026.
The early disclosure raised concerns because hackers could study the published information to develop attacks before affected devices receive updates.
Fixing the problem could also take time because many hardware manufacturers use the affected software in different products.
Are Personal Computers Affected?
The vulnerability does not affect every computer.
People who use their laptops or desktop computers normally and start them from their internal storage drives are not exposed to this particular attack method.
The main risk is to businesses and organizations that use network booting on servers, storage equipment, and other devices.
Even these systems are only vulnerable if their firmware includes the affected software component.
Intel said none of its currently supported commercial products are known to be affected. However, it advised customers to check with their device manufacturers.
Arm also said the vulnerability does not directly affect its products.
At the time of the original report, AMD, Microsoft, Amazon, AMI, and Phoenix Technologies had not provided responses about possible exposure.
The full list of affected devices remains unclear.
Similar Security Problems Have Been Found Before
Researchers have previously discovered several serious weaknesses in software responsible for starting computers.
These include LogoFail, PixieFail, PKFail, and BootHole. The BlackLotus bootkit has also demonstrated how attackers can target computers during startup.
Such attacks are particularly dangerous because they can interfere with security protections before the operating system loads.
Experts warn that the latest flaw could remain a threat for years, especially for older servers that no longer receive security updates.
What Should Organizations Do?
Security experts recommend that businesses check whether their servers and other equipment use the affected software.
Organizations should contact their hardware manufacturers to confirm whether their devices are vulnerable and ask about available security updates.
They should also consider temporarily disabling network booting if it is not needed.
Keeping existing security protections enabled and monitoring networks for suspicious activity can provide additional protection, although these measures cannot completely prevent the vulnerability.
For now, the biggest challenge is identifying affected devices and getting security updates installed before attackers can exploit the flaw.
The post Hackers Could Hijack Servers Before Windows or Linux Even Starts appeared first on ProPakistani.