In October 2026, a critical vulnerability affected the EDK II reference code of UEFI firmwares. This flaw, referenced as CVE-2026-97631 with a severity score of 9.5 out of 10, was prematurely exposed on GitHub. It directly concerns major industry players such as TianoCore and AMI, as well as environments relying on solutions from Red Hat, Debian, Microsoft, Google, Anthropic, and security experts like Alex Matrosov and Dan Holmes-Mitra.

For a small or medium-sized enterprise, this type of alert might seem abstract, reserved for large infrastructures or tech giants. However, the servers running your management software, databases, or storage spaces all rely on these boot components. That is why at HAGEN ENTREPRISE, we closely monitor these topics to help you navigate technical challenges without the complexity, supported by our IT security and cybersecurity services.

What is happening inside firmware code

The issue stems from the EDK II reference code used to structure the UEFI firmwares of numerous servers and IT equipment. A flaw rated 9.5 out of 10 was inadvertently or early exposed on GitHub. The fix sometimes involves a tiny modification, measured at just 504 bytes, but its implementation proves particularly tricky across a fleet of computers.

Specifically, this vulnerability allows potential attackers to target servers directly via the network right at the boot phase. This is a formidable threat because it operates upstream of standard operating systems like Windows Server or Linux. CIOs and CISOs in large organizations immediately jumped on the issue to plan interventions. Yet, the technical complexity of the patch concerns SMEs just as much, especially those hosting physical servers locally or in colocation racks.

What this concretely changes for an SME

For an SME executive, such an announcement translates into very concrete operational challenges. Your company typically does not have a dedicated team to handle boot-level manipulations. However, the consequences of this flaw demand constant vigilance.

First of all, applying firmware updates requires scheduling maintenance windows, along with careful testing to ensure the system reboots smoothly. A botched firmware flash carries a major risk: turning your servers into useless bricks requiring immediate hardware replacement.

Furthermore, this situation increases the workload for IT teams managing a heterogeneous fleet of older and newer machines. Finally, a particularly thorny issue arises for older equipment: some hardware that has reached end-of-life or specific appliances will simply receive no patch, posing an insoluble risk management problem similar to those discussed in our analysis of open-source software paradoxes in SMEs.

What to do concretely to protect your business

Facing this type of threat targeting hardware and low-level layers, standing still is not an option. Even though updating UEFI firmwares is a heavy operation, it must be integrated into your global protection strategy, much like the compliance measures we detail in our article on financial risks related to GDPR for SMEs. Here are the steps to follow to absorb the shock without endangering your activity:

  • Audit your server fleet: List all physical servers in the company to accurately identify manufacturers, BIOS versions, and installed UEFI firmwares.
  • Check manufacturer support: Review supplier advisories to see if your current machines have an official patch or if they are permanently obsolete.
  • Plan supervised interventions: Never launch a firmware update without a complete and verified data backup to guard against hardware bricking incidents.

Frequently asked questions about firmware vulnerabilities

What is a UEFI firmware compared to an operating system?

UEFI is the low-level program burned onto the motherboard that executes as soon as you turn on your server, even before launching Windows or Linux. It prepares the hardware and loads the operating system. A flaw at this level grants total control over the machine.

Why is a firmware update risky?

Unlike standard software that installs within the operating system, flashing firmware modifies the read-only memory of the motherboard. If a power outage occurs or if the file is corrupted during the process, the motherboard becomes unusable.

How do I know if my servers are affected by CVE-2026-97631?

You need to cross-reference the components of your servers (particularly the EDK II reference code or suppliers like AMI) with the security advisories published by your IT hardware vendors.

Key takeaways

The critical vulnerability discovered on UEFI firmwares reminds us that an SME's IT security is not limited to passwords or antiviruses. Hardware layers and boot components represent strategic entry points for network attacks. By partnering with Vincent Hagen to audit your infrastructure and plan your updates, you turn a complex technical constraint into an opportunity to sustainably strengthen your business resilience.