16-Year-Old EDK II UEFI Firmware Flaw Allows Code Execution Before Secure Boot on Network-Booting Servers

Scope: EDK II (TianoCore) UEFI firmware implementations supporting PXE network boot, across vendors building on the affected codebase

Severity: Amber

A vulnerability that has existed in EDK II’s PXE network boot implementation for roughly sixteen years was publicly disclosed on October 22, 2026, after a pull request accidentally revealed the flaw’s CVE number and fix weeks ahead of the planned coordinated disclosure date. EDK II is the open-source reference implementation of UEFI firmware that many hardware vendors build their own firmware on top of, meaning the flaw potentially reaches a wide range of server hardware that supports network booting. A specially crafted network message sent during the PXE boot process can crash the boot sequence outright, or on specific vulnerable firmware builds, achieve code execution before Secure Boot has even loaded, which would let an attacker bypass Secure Boot’s protections entirely at the earliest possible point in the startup chain. The fix merged into EDK II’s main development branch on October 15, 2026, but as of October 28, no tagged release of the project has included it yet, meaning organisations cannot simply update to a numbered version and be covered. Microsoft’s Project Mu, a derivative firmware project, has already pulled the fix into its own release branches with tagged builds available since October 26. The flaw is not currently in CISA’s Known Exploited Vulnerabilities catalog and no researcher has reported active exploitation. Organisations running servers that boot over the network via PXE should disable PXE boot on any system where it is not strictly operationally required until a tagged fix is available, and should monitor both TianoCore’s EDK II releases and their specific hardware vendor’s firmware advisories for the patched version.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.