CVE-2026-20901
MediumCVSS 4.0Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Some Intel(R) Xeon(R) processors contain an improper input validation vulnerability in firmware that may allow an escalation of privilege. A startup code and SMM adversary with a privileged user and a high complexity attack may enable data alteration. This requires local access but no user interaction. The vulnerability may impact system integrity (high), but not confidentiality or availability.
Risk Assessment
A local attacker with privileged access can alter system data, potentially leading to integrity compromise or privilege escalation.
Recommendation
Apply firmware updates provided by Intel for affected Xeon processors.
Original NVD description (English source)
Improper input validation for some Intel(R) Xeon(R) processors within firmware may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable data alteration. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and availability (none) impacts.