Quick answers
- Is CVE-2026-0460 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-0460 being exploited in the wild.
- How severe is CVE-2026-0460?
- Informational severity, published 12 November 2026.
- Which products and versions are affected?
- AMD Bootgen.
- Is there a fix for CVE-2026-0460?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-0460 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-0460?
- Check whether you run Amd Bootgen. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
Bootgen fails to properly randomize the salt value used in RSA-PSS padding, instead using a fixed salt, which reduces the entropy of the cryptographic signature and could allow an attacker to predict or forge padding oracle attacks. The vulnerability affects the authentication mechanism for boot images. While no active exploitation has been reported, this weakens the security of the boot chain.
Affected products
- AMD Bootgen
Timeline
- 2026-11-12: disclosed