# Critical cybersecurity vulnerabilities in server software

> Developing situation record from CLSTR: https://clstr.news/situations/critical-cybersecurity-vulnerabilities-in-server-software
> Updated: 2026-10-30T02:12:05.000Z. Sources: 16. Developments: 2.

In late October 2026, two major security vulnerabilities were identified in core server infrastructure components.

First, researchers discovered a critical flaw in the TianoCore EDK II open-source codebase, tracked as CVE-2026-97631. This vulnerability, which carries a CVSS score of 9.5/10, involves a buffer overflow in the PXE-Base Code driver. Because the exploit occurs during the DXE phase of the boot process, it can bypass security mechanisms like Secure Boot. The flaw primarily impacts servers and data center infrastructure that utilize the Preboot Execution Environment (PXE) to boot over a network.

Separately, a critical Linux kernel vulnerability, CVE-2026-98432, was disclosed. This flaw involves a race condition during the assembly of SYNACK responses to retransmitted SYN packets, which can lead to a use-after-free error. On October 27, it was demonstrated that this vulnerability could allow remote command execution with root privileges on servers running Multipath TCP (MPTCP). 

New details released on October 30 indicate the vulnerability carries a severity score of 9.8/10. On October 27, Anthropic demonstrated a successful exploit using AI-generated code that allowed for remote command execution without authentication or user interaction. While the CVE team announced the issue on October 15 and patches have been integrated into stable kernel versions, remediation progress varies by distribution. Amazon Linux 2023 has released updates for kernels 6.18 and 6.12, while some Ubuntu versions were reported as still being in the process of being patched as of late October. Mitigation efforts include kernel updates and the implementation of firewall rules to block specific TCP packets with IP options.

## Claims

- The Linux kernel vulnerability CVE-2026-98432 has a CVSS severity score of 9.8. (reported by 4 sources)
- Anthropic demonstrated an exploit that achieves remote root command execution without authentication. (reported by 4 sources)
- The CVE team publicly disclosed the vulnerability on October 15, 2026. (reported by 4 sources)
- The vulnerability is a use-after-free (UAF) flaw in the IPv4 TCP communication processing. (reported by 3 sources)
- The Anthropic exploit targeted servers using Multipath TCP (MPTCP). (reported by 3 sources)
- Amazon Linux 2023 has released security updates for kernel 6.18 and 6.12. (reported by 1 source)
- As of October 30, no worldwide attacks exploiting this vulnerability have been reported. (reported by 1 source)
- Blocking IP options in TCP packets can serve as a mitigation measure. (reported by 1 source)

## Timeline

### 2026-10-30: Linux kernel vulnerability CVE-2026-98432 allows remote root access

A critical Linux kernel vulnerability (CVE-2026-98432) with a 9.8 severity score allows remote, unauthenticated root access via a use-after-free flaw in IPv4 TCP processing.

4 sources. https://clstr.news/cluster/linux-kernel-vulnerability-cve-2026-98432-poses-remote-execution-risks

### 2026-10-27: TianoCore EDK II UEFI vulnerability threatens global server infrastructure

A critical 9.5-rated UEFI vulnerability (CVE-2026-97631) in TianoCore EDK II allows code execution on servers during the PXE boot process, bypassing Secure Boot before the OS loads.

12 sources. https://clstr.news/cluster/critical-uefi-vulnerability-discovered-in-edk-ii-firmware

---
Cite as: Critical cybersecurity vulnerabilities in server software. CLSTR, https://clstr.news/situations/critical-cybersecurity-vulnerabilities-in-server-software