CVE WatchAug 11, 2026

CVE-2026-20901

Improper input validation for some Intel(R) Xeon(R) processors within firmware may allow an escalation of privilege. Startup code and smm ad

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Aug 11, 2026 · Last modified: Aug 11, 2026 · CWE-20

EPSS · 30d

Not enough EPSS history yet.

Technical description

Improper input validation for some Intel(R) Xeon(R) processors within firmware may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable data alteration. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and availability (none) impacts.

Official references

intel.comhttps://intel.com/content/www/us/en/security-center/advisory/intel-sa-01442.html

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-713904.0 MED

—

———CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue does not require user interaction.10h CVE-2026-703255.5 MED

—

———Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.6h CVE-2026-703235.5 MED

—

———Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally.9h CVE-2026-703225.5 MED

—

———Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.9h CVE-2026-703205.5 MED

—

———Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.6h CVE-2026-703195.5 MED

—

———Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information locally.8h