CVE-2026-97631: One oversized error message could be enough to hack a server that boots over the network

Not listed so far in CISA’s catalog of actively exploited vulnerabilities.

Our analyses

One oversized error message could be enough to hack a server that boots over the network

Hidden for sixteen years in the UEFI firmware of many servers, the flaw could allow code to run before any protection kicks in. Vendor patches are still pending: here is how to limit the risk.

Oct 31, 20262 min read

What to do

Check whether your estate includes the affected product, including internet-facing devices.
Apply the vendor’s patch or mitigations (references below).
Watch for exploitation: this entry is updated if the vulnerability enters the exploited catalog or is the subject of a CERT-FR alert.

References

NVD entry (NIST)