Vendor reports: operationalOpen · vendor status “identified”Vendor incident feed · inferred

CVE-2026-97631 - critical security vulnerability in the EDK II UEFI firmware component

Reported by Hetzner · Cloud & Infrastructure · source last read just now

Official source (opens in a new tab)
Vendor posted
Nov 10, 2026, 14:46 UTC
When the vendor's feed dated it
Resolved
Not yet
Still open
First seen by Statuswall
Before tracking began
Statuswall's clock
Duration
Not available
This source does not publish reliable durations

Summary

Built from the facts below, no AI

Potential impact, not a confirmed outage of your systems.

What the vendor confirmed

  • Hetzner reports operational: "CVE-2026-97631 - critical security vulnerability in the EDK II UEFI firmware component".[E1, E2]
  • It is not resolved yet (vendor status "identified").[E3, E7]

What is unknown

  • Which regions are affected: the vendor did not say.[E5]
  • Which components are affected: the vendor did not say.[E6]
  • Whether your own systems are affected: a vendor report cannot tell you; check your monitoring.
  • When it will be resolved: no estimate is shown unless the vendor publishes one on its page.

Last update in these facts: 2026-11-10 14:46 UTC · summary s1, evidence e642f6aa78575a54

Evidence (7)
  1. E1Hetzner reports operational. (vendor) source (opens in a new tab)
  2. E2Vendor title: "CVE-2026-97631 - critical security vulnerability in the EDK II UEFI firmware component". (vendor) source (opens in a new tab)
  3. E3Vendor status word: "identified". (vendor) source (opens in a new tab)
  4. E4Vendor posted it: 2026-11-10 14:46 UTC. (vendor) source (opens in a new tab)
  5. E5The vendor did not state which regions are affected. (Statuswall)
  6. E6The vendor attached no components. (Statuswall)
  7. E7Not resolved by the vendor yet. (vendor) source (opens in a new tab)

Affected scope

Not stated by the vendor

Components: not stated by the vendor

No region Statuswall recognises is stated for this incident (place names and provider-specific codes are not converted). It is not assumed to be global.

Potential relevance

Hetzner is not in your stack. Follow it to see whether reports like this fall inside the regions you use.

What to check on your side

Verification steps only. Statuswall cannot see your systems.

  • Check resource health in the regions named by the vendor, and in your other regions for comparison.
  • Separate control-plane actions (deploys, scaling, console) from data-plane traffic: they often fail differently.
  • If you run multi-region or failover, confirm what your own health checks report before acting.
  • Check error rates, latency and timeouts in your own monitoring for requests that depend on Hetzner.
  • Look at synthetic checks and alerts that exercise Hetzner.
  • Compare with recent deploys on your side, so a coincidental change is not blamed on the vendor.
  • Follow the vendor's official incident page for scope changes and resolution.

Timeline

Vendor times come from the vendor. “Seen by Statuswall” times are when Statuswall noticed a change, which can lag the vendor by a few minutes. Statuswall does not store the vendor's update text; read it on the official page.

  1. Nov 10, 2026, 14:46 UTCVendor posted this incidentVendor time

No changes observed yet. Statuswall began recording changes on incidents in November 2026.