Is CVE-2026-20463 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-20463 being exploited in the wild.

How severe is CVE-2026-20463?

Informational severity, with a CVSS score of 0, published 1 July 2026.

Which products and versions are affected?

MediaTek Chipset MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6986D, MT6988.

Is there a fix for CVE-2026-20463?

A patch was published on 2026-07-01: Patch ID MOLY01716533 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-20463 attacked?

It is attacked with local access, in device firmware.

Am I affected by CVE-2026-20463?

Check whether you run MediaTek Chipset at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-20463: MediaTek Modem privilege escalation in multiple chipsets

CVE-2026-20463 · Severity: info · CVSS 0 · Published 2026-07-01

A vulnerability in the modem component of various MediaTek chipsets could allow an attacker to gain elevated system privileges. These chipsets are used in a wide range of mobile devices to manage cellular connectivity. If an attacker already has basic system access, they could exploit this flaw to bypass security permissions and take deeper control of the device without any user interaction.

Technologies: MediaTek Chipset. Vendors: MediaTek.

Quick answers

Is CVE-2026-20463 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-20463 being exploited in the wild.
How severe is CVE-2026-20463?: Informational severity, with a CVSS score of 0, published 1 July 2026.
Which products and versions are affected?: MediaTek Chipset MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6986D, MT6988.
Is there a fix for CVE-2026-20463?: A patch was published on 2026-07-01: Patch ID MOLY01716533 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-20463 attacked?: It is attacked with local access, in device firmware.
Am I affected by CVE-2026-20463?: Check whether you run MediaTek Chipset at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A permissions bypass vulnerability (CWE-280) exists in the Modem component of multiple MediaTek chipsets. The flaw allows a local attacker who has already obtained 'System' level privileges to further escalate their authority. Exploitation does not require user interaction. The vulnerability affects a broad range of MT-series chipsets, including various 4G and 5G models. MediaTek has released a patch under Patch ID MOLY01716533 to address this issue.

Affected products

MediaTek, Inc. MediaTek chipset MT2716, MT2735, MT2737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT6779, MT6781, MT6783, MT6785, MT6789, MT6813, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6986D, MT6988

Timeline

2026-07-01: advisory: Published by MediaTek and NVD
2026-07-01: patched: Patch ID MOLY01716533 released

References

https://corp.mediatek.com/product-security-bulletin/July-2026

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.