Recover From the Attacks You Don't Detect
Veeam, Thursday, October 29th, 2026
Veeam's Brad Linch uses a UEFI firmware flaw to argue that organizations need recovery plans for attacks their detection tools cannot see.
In a Veeam blog post, Brad Linch of Veeam's Office of the CTO cites CVE-2026-97631, a critical buffer overflow in TianoCore EDK II PXE network boot code that sits below the operating system and can evade OS-level security tools.
He notes exposure is limited and no in-the-wild exploitation was confirmed as of October 28, 2026.
He argues recovery requires an immutable copy outside the blast radius, a verified clean restore point and a trusted destination, since restoring to suspect hardware does not solve the problem.
He recommends mapping affected systems, protecting the recovery path, planning restore-point selection and testing recovery of a critical application, and mentions Veeam tools such as SureBackup and Recovery Orchestrator.