Anyone using PXE boot?
A pre-boot RCE (CVE-2026-97631, CVSS 9.5) in the EDK II PXE driver was published last week.
Attackers can send ICMPv4 or ICMPv6 errors to the machine while booting and can gain code execution before Secure Boot. Great!
https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m
