Is CVE-2026-20901 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-20901 being exploited in the wild.

How severe is CVE-2026-20901?

High severity, published 11 August 2026.

Which products and versions are affected?

Intel Trust Domain Extensions (TDX) firmware; Google Compute Engine Confidential VMs.

Is there a fix for CVE-2026-20901?

A patch was published on 2026-08-11: Google proactively applied firmware upgrades to server fleet Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-20901 attacked?

It is attacked with local access or from the adjacent network, in device firmware.

Am I affected by CVE-2026-20901?

Check whether you run Google Compute Engine Confidential VMs, Google Cloud Platform or Intel Trust Domain Extensions (TDX) firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-20901: Intel TDX firmware confidential VM escape

CVE-2026-20901 · Severity: high · Published 2026-08-11

Intel Trust Domain Extensions (TDX) firmware used in Google Cloud Confidential VMs contains multiple security vulnerabilities that could allow a privileged host administrator to bypass security checks, access restricted memory areas, or decrypt guest data. This undermines the foundational security guarantee of Confidential VMs—that cloud provider administrators cannot access customer workload data. Google has already patched all affected servers and no customer action is required.

Technologies: Google Cloud Platform. Vendors: Google, Intel.

Quick answers

Is CVE-2026-20901 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-20901 being exploited in the wild.
How severe is CVE-2026-20901?: High severity, published 11 August 2026.
Which products and versions are affected?: Intel Trust Domain Extensions (TDX) firmware; Google Compute Engine Confidential VMs.
Is there a fix for CVE-2026-20901?: A patch was published on 2026-08-11: Google proactively applied firmware upgrades to server fleet Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20901 attacked?: It is attacked with local access or from the adjacent network, in device firmware.
Am I affected by CVE-2026-20901?: Check whether you run Google Compute Engine Confidential VMs, Google Cloud Platform or Intel Trust Domain Extensions (TDX) firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

These vulnerabilities affect Intel TDX firmware used to isolate and protect guest virtual machines from host-level access. The flaws allow a privileged host adversary to bypass attestation verification mechanisms, access restricted TDX module registers, or decrypt guest memory that should remain confidential. The attack requires high-level host privileges (kernel-level or hypervisor access) but no guest-side interaction or network access. Google has proactively deployed firmware patches across the entire server fleet; customers who did not receive direct upgrade notification are already protected.

Affected products

Intel Trust Domain Extensions (TDX) firmware
Google Compute Engine Confidential VMs

Identifiers

CVE-2026-20901
CVE-2025-31938
CVE-2026-20705
CVE-2026-20898
CVE-2025-35973
CVE-2026-20713
CVE-2026-20775
CVE-2026-20885
CVE-2025-31356

Timeline

2026-08-11: disclosed: GCP-2026-053 published
2026-08-11: patched: Google proactively applied firmware upgrades to server fleet

References

https://docs.cloud.google.com/support/bulletins/index

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.