Is CVE-2025-35990 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-35990 being exploited in the wild.

How severe is CVE-2025-35990?

High severity, with a CVSS score of 8.8, published 12 May 2026.

Which products and versions are affected?

Intel Endpoint Management Assistant before 1.14.5.

Is there a fix for CVE-2025-35990?

A patch was published on 2026-05-12: Update to version 1.14.5 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-35990 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2025-35990?

Check whether you run Intel Endpoint Management Assistant at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-35990: Intel Endpoint Management Assistant privilege escalation via improper input validation

CVE-2025-35990 · Severity: high · CVSS 8.8 · Published 2026-05-12

Intel Endpoint Management Assistant (EMA) is a software tool used by IT administrators to remotely manage and repair computers. A security flaw in this software could allow an unauthorized person on the same local network to gain elevated administrative privileges on the system. This could lead to a complete takeover of the affected computer, allowing the attacker to access sensitive data or disrupt operations.

Vendors: Intel.

Quick answers

Is CVE-2025-35990 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-35990 being exploited in the wild.
How severe is CVE-2025-35990?: High severity, with a CVSS score of 8.8, published 12 May 2026.
Which products and versions are affected?: Intel Endpoint Management Assistant before 1.14.5.
Is there a fix for CVE-2025-35990?: A patch was published on 2026-05-12: Update to version 1.14.5 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-35990 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2025-35990?: Check whether you run Intel Endpoint Management Assistant at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in Intel Endpoint Management Assistant (EMA) software prior to version 1.14.5 is caused by improper input validation within Ring 3 (User Applications). The flaw allows an unauthenticated, unprivileged attacker with adjacent network access to achieve escalation of privilege. The attack is characterized by low complexity and requires no user interaction or special internal knowledge. Successful exploitation grants the attacker high impact across confidentiality, integrity, and availability. Intel has released version 1.14.5 to mitigate this issue.

Affected products

Intel Endpoint Management Assistant (EMA) before 1.14.5

Timeline

2026-05-12: disclosed: Initial advisory release by Intel
2026-05-12: patched: Update to version 1.14.5 released

References

https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01434.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.