11/13 7:20AM EST Update:
Our teams have been monitoring Microsoft’s restoration efforts throughout the night and are beginning to see signs of significant remediation, particularly with email, with many previously inaccessible services now functioning. Many services remain degraded and we will continue to monitor. We are encouraged to see Microsoft prioritizing ensuring email backlogs are eventually delivered and have seen evidence that emails sent from external services during the outage have been delivered as services have returned. While Microsoft has not seen any signs of malicious activity associated with the event, we encourage everyone to remain vigilant as the outages can often see associated social engineering attacks.

Systems Engineering is aware of a Microsoft 365 service degradation currently affecting email services, including our own ability to send and receive email. This is a Microsoft-side issue and is not isolated to any single client environment.

You can see more information, including live status updates at Microsoft's service status page here.

All of our internal platforms — including our service desk, remote monitoring and management, and security operations — continue to operate as normal, and our teams are closely monitoring the situation as Microsoft works to mitigate the issue.

We are not recommending any changes to your environment at this time. We urge patience while Microsoft restores service; unnecessary changes made during a provider-side outage can complicate recovery.

As always, please reach out to us via phone for urgent issues, we anticipate email flow resuming shortly, and are awaiting guidance on Microsoft should there be a need to re-send any emails sent during this service disruption.

Thank you for your patience.

A newly disclosed vulnerability, CVE-2026-97631, affects a network-boot component within TianoCore EDK II, technology used in some UEFI firmware.  The vulnerability has received a critical 9.5 severity rating because successful exploitation could potentially allow an attacker to execute code before the operating system and endpoint security controls load.

What is the actual risk?

Despite its critical rating, exploitation requires specific conditions.  The vulnerable functionality is associated with PXE network boot, meaning an attacker must be able to communicate with an affected system while it is actively performing a network boot.

For most client environments, this significantly reduces practical exposure.  Servers and infrastructure protected behind properly configured firewalls such as FortiGate or Cisco, without Internet-accessible management or provisioning interfaces, are not ordinarily exposed to this attack directly from the Internet.

A remote attacker would generally need to first establish an internal foothold or otherwise gain access to a network capable of reaching the affected system during PXE boot.

Systems that do not use PXE or UEFI network boot have substantially less exposure to this vulnerability.

What Systems Engineering is doing

• Monitoring HPE, Dell, HP, Lenovo, and NetApp for product-specific security advisories and firmware updates.
• Evaluating the use of PXE and UEFI network boot across applicable infrastructure.
• Reviewing network segmentation and exposure of provisioning infrastructure where applicable.
• Planning review and deployment strategies for vendor-approved firmware updates where affected products are identified.

What should you do?

Systems protected by properly configured firewalls and without exposed network-boot services do not currently require emergency client action.

Where PXE or UEFI network boot is not required, we recommend disabling the functionality as an additional precaution.  Organizations using PXE should ensure provisioning networks are isolated from untrusted, guest, wireless, and unnecessary user networks.

We will continue monitoring vendor guidance and will work directly with affected clients if remediation becomes necessary.

Our Assessment

Severity: Critical | Practical risk for most managed environments: Low

CVE-2026-97631 demonstrates why vulnerability severity alone does not determine organizational risk.  Existing controls such as network segmentation, restricted management access, firewall protections, and reducing unnecessary services can significantly limit real-world exploitability while vendors develop and distribute firmware updates.

Questions?

If you have questions related to this finding or would like assistance in reviewing your computing system for vulnerable access to these risk factors, please contact your Account Manager at Systems Engineering directly.