CVE-2026-20898: Intel Xeon Alias Checking Trusted Module privilege escalation

CVE-2026-20898 · Severity: high · CVSS 7.2 · Published 2026-08-11

The Alias Checking Trusted Module in Intel Xeon processors contains a firmware vulnerability that could allow a privileged local attacker to escalate their privileges further, potentially gaining unauthorized access to sensitive system operations. An attacker with existing high privileges and local system access could exploit a flaw in startup code or System Management Mode to bypass security controls, potentially compromising the confidentiality and integrity of data processed by the processor.

Vendors: Intel.

Quick answers

Is CVE-2026-20898 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-20898 being exploited in the wild.
How severe is CVE-2026-20898?
High severity, with a CVSS score of 7.2, published 11 August 2026.
Which products and versions are affected?
Intel Xeon Scalable Processor (4th Gen) Affected models with CPU ID 806F7, 806F8; Intel Xeon Scalable Processor (5th Gen) Affected model with CPU ID C06F2; Intel Xeon6 processor with E-cores Affected model with CPU ID A06F2; Intel Xeon6 processor with P-cores Affected models with CPU ID A06D0, A06D1, A06E0, A06E1; and 1 more.
Is there a fix for CVE-2026-20898?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20898 attacked?
It is attacked with local access.
Am I affected by CVE-2026-20898?
Check whether you run Intel Xeon Scalable Processor (4th Gen), Intel Xeon Scalable Processor (5th Gen), Intel Xeon6 processor with E-cores or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is an improper access control issue in the firmware of the Alias Checking Trusted Module (ACTM) affecting certain Intel Xeon processors. The root cause lies in inadequate access controls in startup code and System Management Mode (SMM), allowing a privileged local adversary to escalate privileges through a high-complexity attack. Exploitation requires local access and an existing privileged user context, but does not require user interaction or special knowledge. Successful exploitation results in high impact to system confidentiality and integrity. Intel is releasing firmware updates from system manufacturers to mitigate this vulnerability.

Affected products

  • Intel Xeon Scalable processor (4th Gen) Affected models with CPU ID 806F7, 806F8
  • Intel Xeon Scalable processor (5th Gen) Affected model with CPU ID C06F2
  • Intel Xeon6 processor with P-cores Affected models with CPU ID A06D0, A06D1, A06E0, A06E1
  • Intel Xeon6 SoC Affected model with CPU ID A06E1
  • Intel Xeon6 processor with E-cores Affected model with CPU ID A06F2

Timeline

  • 2026-08-11: disclosed: INTEL-SA-01439 advisory published; CVE-2026-20898 disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.