Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers
At a glance
- Severity
- Medium
- Used in attacks
- No flaws named
- Industries
- SaaS & technology
- Reported by
- 1 outlet
A critical 16-year-old flaw in EDK II, the open-source code that most hardware makers use to build UEFI firmware, can allow an attacker to run code on a machine before its operating system loads, but only while the machine is booting over the network. UEFI firmware is the software that runs first when a computer is switched on, before the operating system. An attacker who can reach the machine…
We summarise and link; this source is not one we hold a licence to reproduce. Everything below is what CyberBrief adds: the vulnerabilities involved, whether they are being exploited, who is named, and who else covered it.
Fastnexa security experts
Dealing with this in your own company?
If this story touches software, suppliers or systems you use, a Fastnexa security expert can tell you what it means for you and what to do first.
Think you’ve already been hit? Don’t wait on a form: call or WhatsApp +1 (732) 454 2616. We reply within 1 hour, 24/7. Emergency help →
Coverage
One outlet has carried this so far.
2026-10-28 11:50 UTC
Related stories
- Alpine Linux rebuilds GitLab after attempted RCE attack
BleepingComputer · 2026-11-01
- Northstar Security Exits Stealth With $7M to Expose Toxic Risk Combinations
SecurityWeek · 2026-11-01
- CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key
The Hacker News · 2026-11-01
- New Android SMS of Death exploit can remotely crash unpatched phones
BleepingComputer · 2026-10-31
- Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
The Hacker News · 2026-10-31 · exploited