Anthropic and Google security specialists found a severe vulnerability inside software relied upon widely by data centers and server makers globally.

Known as CVE-2026-97631, this 16-year-old bug holds a severity score of 9.5 out of 10.

It permits hackers to execute malicious code prior to the startup of a computer operating system, granting potential access to key system controls and sensitive data.

The issue impacts TianoCore EDK II, which is startup assistance software. Prominent firmware producers like Phoenix, AMI, and Insyde use this code, alongside Microsoft's Project Mu.

How Hackers Could Exploit the Flaw

Servers and computers capable of initiating startup through downloaded network files instead of internal storage drives are impacted.

Data centers and businesses frequently employ this network booting method to handle large quantities of machines.

Investigators found that the vulnerable software fails to properly verify the size of specific network messages.

Attackers can transmit a crafted message containing excessive data that the software cannot manage securely.

Such action can freeze the computer during startup or let intruders run unauthorized code across IPv4 and IPv6 network links.

Hackers Could Bypass Important Security Protections

The primary worry is that perpetrators might exploit the flaw before operating systems and security defenses activate fully.

This sequence can yield high-level authority over a compromised machine for the attacker.

HD Moore, a security expert, cautioned that bad actors could access sensitive security tools and undermine disk encryption under specific conditions.

Malware installed via this vulnerability might also persist on the machine past a reboot.

Still, perpetrators generally require access to the target network, and their exploits need tailoring for distinct software and hardware versions.

At present, no proof exists showing the bug permits outsiders to breach a protected network.

Security Flaw Was Revealed Earlier Than Planned

Dan Holmes of Google and Alex Matrosov of Anthropic uncovered the vulnerability.

The researchers intended to make the issue public in January, providing manufacturers time to craft security patches.

However, AMI, a hardware maker, published details about the vulnerability and a potential fix ahead of schedule.

The TianoCore Project subsequently issued a public security advisory on October 22, 2026.

This early publication sparked anxiety because hackers could analyze the data to build exploits before devices obtain patches.

Resolving the issue may also require extended time since numerous hardware vendors incorporate the affected code across varying products.

Are Personal Computers Affected?

The bug does not impact every single computer.

Individuals using desktop computers or laptops normally and booting from internal storage drives face no exposure to this attack vector.

Storage equipment, servers, and other hardware using network booting within businesses face the primary danger.

Even those setups remain vulnerable solely if their firmware incorporates the impacted software component.

Intel reported that none of its currently supported commercial products face known impacts, though it urged clients to verify with device makers.

Arm stated the bug does not directly influence its merchandise.

Microsoft, AMD, Amazon, Phoenix Technologies, and AMI had not replied regarding potential exposure when the original report came out.

The complete inventory of impacted devices remains uncertain.

Similar Security Problems Have Found Before

Researchers previously uncovered multiple major weaknesses inside computer startup software.

Those instances include PixieFail, LogoFail, BootHole, and PKFail, alongside the BlackLotus bootkit, which demonstrated startup targeting methods.

Attacks of this nature prove particularly dangerous by disrupting security defenses prior to OS loading.

Specialists caution that this recent bug may endure as a threat for years, particularly concerning older servers lacking ongoing security updates.

What Should Organizations Do?

Security specialists advise firms to verify whether their equipment and servers run the impacted software.

Enterprises ought to reach out to hardware makers to confirm vulnerability status and inquire about security patches.

Turning off network booting temporarily when unneeded is another recommended step.

Maintaining active security controls and watching networks for unusual behavior supplies extra defense, though these steps fail to completely block the vulnerability.

Identifing impacted hardware and deploying patches prior to attacker exploitation remains the largest hurdle today.