EDK2's boot flaw needs network reachability and a firmware fix CVE-2026-97631 can run code during PXE network boot. Disable unused network boot, isolate provisioning traffic and ask hardware vendors for a firmware build containing the upstream fix.