Affected Systems
EDK II up to and including edk2-stable202608 (August 2026). Affects network-booting servers and data center equipment using PXE boot. Impacts RHEL 8/9/10, SUSE, Debian edk2 packages. Potentially affects firmware from AMI, Insyde, Phoenix, and Microsoft Project Mu. Intel and Arm products reportedly not affected. Home/office systems booting from local disk are not vulnerable.
Exploitation Status
No public PoC available. Exploitation requires attacker on adjacent network during PXE boot window. Denial-of-service (boot hang) is trivial; code execution requires tailored exploit for specific firmware build. No known active exploitation. Coordinated disclosure was planned for January 2027 but details leaked September 28, 2026.
Business Impact
Attackers on adjacent network can crash network-booting servers or execute code before Secure Boot loads, bypassing boot-time integrity checks. Code runs once but can install persistent bootkit. Impact limited to organizations using PXE boot (primarily data centers, server environments). No patch available in stable EDK II release yet; firmware vendors must integrate fix and ship BIOS/UEFI updates before mitigation is possible. Microsoft Project Mu has released patched builds as of October 26, 2026.
Urgency
🟡 Within a week
Recommended Actions
- Disable PXE network boot in UEFI/BIOS settings on all servers where network boot is not operationally required
- Implement network segmentation to restrict access to boot-time network traffic; limit ICMP and DHCP/TFTP traffic to trusted management networks only
- Monitor boot-time network traffic and UEFI/BIOS logs for anomalous ICMP error messages or failed PXE boot attempts
- Contact firmware vendor (AMI, Insyde, Phoenix, OEM) to confirm vulnerability status and request timeline for patched BIOS/UEFI update incorporating EDK II fix from October 15, 2026
- For RHEL 8/9/10, SUSE, and Debian environments, monitor vendor security advisories for edk2 package updates and apply immediately when available