Network boot is a short window with a powerful trust boundary. Check the firmware that actually runs during provisioning and recovery.
New Microsoft applicability — October 31, 2026, 01:12:37 UTC. MSRC added CVE-2026-97631 / GHSA-99cj-7hg9-mp4m for azl3 edk2 20240524git3e722403cd16-20 (Important) and azl3 qemu 10.1.0-1 (Critical), on Azure Linux 3.0. Both fixed-build and download fields are blank; Microsoft supplies no numeric CVSS.
Applicability and patch limits
TianoCore published its advisory October 22, rating it Critical, CVSS 4.0 9.5. It identifies EDK II master as of September 14, 2026; a complete released firmware version range is not supplied.
During IPv4 or IPv6 PXE boot, crafted ICMP error messages can corrupt DXE memory, enabling pre-OS code execution or a boot hang. The attacker must reach the booting client; the advisory does not limit this to the local network segment. Normal post-boot operation is not the stated trigger, and Secure Boot is not a fix for this earlier firmware flaw.
The advisory links code-fix pull request #13302 but still lists no patched version. A released, supported Azure Linux RPM, QEMU guest-firmware package or OEM firmware build incorporating the fix is not verified. EDK II ancestry alone does not establish that Hyper-V, VMware, every QEMU deployment or a Microsoft-managed Azure service is affected.
MSP action
Suggested priority: high where affected firmware uses reachable PXE boot. Inventory actual firmware provider/build, guest firmware files and IPv4/IPv6 network-boot settings → as a tested MSP precaution, isolate provisioning/recovery networks from untrusted senders or disable unnecessary PXE without breaking recovery → obtain the platform vendor’s supported fixed firmware/package and upgrade path; do not substitute an upstream source patch into an appliance → verify the running firmware contains the correction and test boot, recovery and network health. Keep the remediation ticket open until the supported build is confirmed. No complete vendor workaround was verified.
Official sources
MSRC October CVRF · MSRC CVE-2026-97631 · TianoCore advisory · CISA KEV data
No active-exploitation claim was verified in the reviewed official material. MSRC’s exploitation fields are blank, which is not confirmation of no exploitation. This CVE is absent from the full CISA KEV catalog 2026.10.30 (1,766 records), checked October 31; no KEV federal deadline applies. No mandatory compromise-check or credential-rotation procedure was verified for this CVE. Investigate suspicious activity under the environment’s incident-response process.
Last verified: October 31, 2026. Applicability and deployment-specific fixes require validation.