CVE-2026-6726
HighCVSS 7.9Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
An information leakage vulnerability in the TCG TPM 2.0 reference code could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key and falsify other TPM 2.0 attestations with this key.
Risk Assessment
Risk of unauthorized credential acquisition and attestation forgery, undermining hardware trust.
Recommendation
Apply patches per TCG VRT0010 and monitor TPM key activities.
Other vulnerabilities in TPM 2.0
See all- CVE-2026-6727Medium
A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker may exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys, including the Endorsement Key (EK). Under certain conditions, this may also enable forgery of TPM 2.0 attestations.
- CVE-2026-6923Low
A side-channel attack requiring physical presence at the TPM can lead to extraction of an Elliptic Curve Diffie-Hellman (ECDH) key. The vulnerability affects protection of cryptographic keys stored in the TPM.
Original NVD description (English source)
An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key (such as an Attestation Key, DevID Key or TLS authentication key) and falsify other TPM 2.0 attestations with this key. See also TCG VRT0010.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS