# CVE-2026-20885: Intel TDX module improper authentication in Ring 0

Source: https://junglewise.ai/threats/cve-2026-20885-intel-tdx-module-improper-authentication-in-ring-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-20885 · Severity: high · CVSS 7.2 · Published 2026-08-11

Intel's Trust Domain Extensions (TDX) module, a security feature used in Xeon processors to isolate and protect sensitive workloads, contains improper authentication in its Ring 0 (kernel-level) Trust Domain component. An attacker with privileged system software access and high technical complexity can bypass authentication controls to disclose sensitive information or escalate privileges. This could allow compromise of confidential data processed by TDX-protected applications and gain deeper control over the system.

Technologies: [Intel 4th Gen Xeon Scalable processor](https://junglewise.ai/threats/technologies/4th-gen-xeon-scalable-processor), [Intel 5th Gen Xeon Scalable processor](https://junglewise.ai/threats/technologies/5th-gen-xeon-scalable-processor), [Intel Xeon 6 processor with P-cores](https://junglewise.ai/threats/technologies/xeon-6-processor-with-p-cores), [Intel Xeon 6 SoC](https://junglewise.ai/threats/technologies/xeon-6-soc). Vendors: [Intel](https://junglewise.ai/threats/vendors/intel).

## Quick answers

**Is CVE-2026-20885 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20885 being exploited in the wild.

**How severe is CVE-2026-20885?** High severity, with a CVSS score of 7.2, published 11 August 2026.

**Which products and versions are affected?** Intel 4th Gen Xeon Scalable processor 1.5.28 and earlier; Intel 5th Gen Xeon Scalable processor 1.5.28 and earlier; Intel Tdx Module 1.5.28 and earlier (4th/5th Gen Xeon Scalable); 2.0.16 and earlier (Xeon 6); Intel Xeon 6 processor with P-cores 2.0.16 and earlier; and 1 more.

**Is there a fix for CVE-2026-20885?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-20885 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2026-20885?** Check whether you run Intel 4th Gen Xeon Scalable processor, Intel 5th Gen Xeon Scalable processor, Intel Tdx Module or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-20885 is an improper authentication vulnerability in the Intel TDX module's Ring 0 Trust Domain component. The vulnerability requires local access combined with high attack complexity and privileged user context; it is not remotely exploitable. A system software adversary with elevated privileges can exploit this to achieve information disclosure and privilege escalation. The vulnerability has a CVSS 4.0 score of 7.0 with vector CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N. Intel has released firmware updates as mitigations; system administrators should apply vendor-provided patches.

## Affected products

- Intel TDX module 1.5.28 and earlier (4th/5th Gen Xeon Scalable); 2.0.16 and earlier (Xeon 6)
- Intel 4th Gen Xeon Scalable processor 1.5.28 and earlier
- Intel 5th Gen Xeon Scalable processor 1.5.28 and earlier
- Intel Xeon 6 processor with P-cores 2.0.16 and earlier
- Intel Xeon 6 SoC 2.0.16 and earlier

## Timeline

- 2026-08-11: disclosed: CVE-2026-20885 publicly disclosed via Intel security advisory INTEL-SA-01436

## References

- [https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01436.html](https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01436.html)

## Related threats

- [Intel TDX module uncaught exception denial of service](https://junglewise.ai/threats/cve-2026-20775-intel-tdx-module-uncaught-exception-denial-of-service)
- [Intel Processors privilege escalation in Ring 3 user applications](https://junglewise.ai/threats/cve-2026-20716-intel-processors-privilege-escalation-in-ring-3-user-applications)
- [Intel Xeon firmware control flow privilege escalation](https://junglewise.ai/threats/cve-2026-20713-intel-xeon-firmware-control-flow-privilege-escalation)
- [Intel TDX module insecure storage of sensitive information](https://junglewise.ai/threats/cve-2026-20705-intel-tdx-module-insecure-storage-of-sensitive-information)
- [Intel Trust Domain Extensions data authenticity verification bypass](https://junglewise.ai/threats/cve-2025-31356-intel-trust-domain-extensions-data-authenticity-verification)