CVE-2026-20713: Intel Xeon firmware control flow privilege escalation

CVE-2026-20713 · Severity: info · CVSS 4.5 · Published 2026-08-11

Intel Xeon processors contain a firmware vulnerability that could allow a privileged attacker on the local system to escalate their privileges further. An exploit requires system-level access, high technical complexity, and knowledge of internal processor details. If successful, an attacker could gain unauthorized read and write access to protected system memory and data.

Technologies: Intel Xeon 6 processor with P-cores, Intel Xeon 6 SoC. Vendors: Intel.

Quick answers

Is CVE-2026-20713 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20713 being exploited in the wild.
How severe is CVE-2026-20713?
Informational severity, with a CVSS score of 4.5, published 11 August 2026.
Which products and versions are affected?
Intel Xeon 6 Processor with E-cores All versions prior to microcode mitigation; Intel Xeon 6 processor with P-cores All versions prior to microcode mitigation; Intel Xeon 6 SoC All versions prior to microcode mitigation; Intel Xeon Scalable Processor (4th Gen) All versions prior to microcode mitigation; and 2 more.
Is there a fix for CVE-2026-20713?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20713 attacked?
It is attacked with local access, in device firmware.
Am I affected by CVE-2026-20713?
Check whether you run Intel Xeon 6 Processor with E-cores, Intel Xeon 6 processor with P-cores, Intel Xeon 6 SoC or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An always-incorrect control flow implementation in Intel Xeon processor firmware allows privilege escalation when exploited by a system software adversary. The vulnerability requires the attacker to already possess privileged user access and involves a high-complexity local attack with no additional special requirements beyond system knowledge. The root cause stems from improper control flow logic in the processor's firmware that fails to enforce proper access boundaries. Exploitation can result in high impact to system confidentiality and integrity by allowing an attacker to read and modify protected memory regions. Intel is addressing this through microcode updates distributed via system manufacturers.

Affected products

  • Intel Xeon Scalable Processor (4th Gen) All versions prior to microcode mitigation
  • Intel Xeon W2400 and W3400 Processors All versions prior to microcode mitigation
  • Intel Xeon Scalable Processor (5th Gen) All versions prior to microcode mitigation
  • Intel Xeon 6 Processor with P-cores All versions prior to microcode mitigation
  • Intel Xeon 6 SoC All versions prior to microcode mitigation
  • Intel Xeon 6 Processor with E-cores All versions prior to microcode mitigation

Timeline

  • 2026-08-11: disclosed: Intel PSIRT advisory INTEL-SA-01442 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.