Hackers Could Hijack Servers Before Windows or Linux Even Starts

Security researchers from Google and Anthropic have uncovered a severe vulnerability (CVE-2026-97631) in widely-used software by server manufacturers and data centers. This 16-year-old flaw, rated 9.5 out of 10 in severity, could enable hackers to execute malicious code before a computer's operating system fully starts. The problem affects TianoCore EDK II, a software essential for computers to boot up.

Major firmware companies like AMI, Insyde, and Phoenix incorporate this software into their products. Microsoft's Project Mu also integrated the affected code.

Exploiting the flaw is possible when computers and servers use network booting to load files from a network rather than local storage drives, a common practice in businesses and data centers. The vulnerability arises due to the software's inability to adequately verify the size of specific network messages. Hackers could manipulate messages to overload the software, causing the computer to freeze during startup or allowing the execution of malicious code. Both IPv4 and IPv6 network connections are susceptible to this exploit.

The most alarming aspect is that attackers could infiltrate the system before the operating system and security safeguards are fully operational, granting them extensive control over the affected device. Security expert HD Moore cautioned that hackers might access sensitive security components, potentially bypass disk encryption under certain conditions.

Installing persistent malware upon system restart is also a possibility, though attackers typically need access to the target’s network, requiring hardware and software-specific adjustments.

The vulnerability's disclosure was earlier than initially planned. Researchers Alex Matrosov of Anthropic and Dan Holmes of Google discovered it, initially intending to disclose it in January. However, hardware manufacturer AMI released information about the flaw and a suggested fix ahead of schedule. Subsequently, the TianoCore Project issued a public security advisory on October 22, 2026, raising concerns as hackers could study the disclosed data to craft attacks before affected devices receive updates.

Fixing the issue may also be time-consuming, as many hardware manufacturers employ the affected software across various products.

Ordinary computers, particularly those starting from internal storage drives, are not vulnerable to this specific attack. However, businesses and organizations utilizing network booting on servers, storage equipment, and similar devices face a significant risk. Intel stated none of its supported commercial products are affected.

Arm also declared the vulnerability does not directly impact its products. At the time of the original report, AMD, Microsoft, Amazon, AMI, and Phoenix Technologies had not commented on potential exposures. The complete list of affected devices remains undisclosed. Past security issues, such as LogoFail, PixieFail, PKFail, BootHole, and the BlackLotus bootkit, highlight the persistent threat of startup-based attacks, which can circumvent security measures before the operating system loads.

Experts emphasize that the latest flaw could persist for years, particularly in older servers that no longer receive security updates. Organizations are advised to verify whether their servers and other equipment utilize the compromised software, contact hardware manufacturers for vulnerability confirmation and security updates, consider temporarily disabling network booting if unnecessary, maintain existing security measures, and monitor networks for any unusual activity.