Executive brief
Intel Xeon server processors contain a firmware vulnerability allowing privilege escalation through improper input validation in startup code and System Management Mode (SMM). An attacker with existing privileged access and local system access could modify system integrity through a complex attack, potentially compromising the security guarantees of the server platform.
Technical details
The vulnerability is an improper input validation flaw in Intel Xeon processor firmware, specifically affecting startup code and System Management Mode (SMM) execution paths. The vulnerability requires local access combined with privileged user context and high attack complexity; an adversary must have existing elevated privileges on the system. Exploitation allows data alteration and integrity compromise of the system, with CVSS score of 4.0 indicating medium severity with high integrity impact (SI:H). Intel recommends updating to the latest microcode versions provided by system manufacturers; patches were released with the advisory on 2026-08-11.
Affected products
- Intel Xeon Scalable (4th Gen) CPU ID 806F7, 806F8
- Intel Xeon W2400 CPU ID 806F8
- Intel Xeon W3400 CPU ID 806F8
- Intel Xeon Scalable (5th Gen) CPU ID C06F2
- Intel Xeon6 (P-cores) CPU ID A06D0, A06D1, A06E0, A06E1
- Intel Xeon6 SoC CPU ID A06E1
Timeline
- 2026-08-11: disclosed: Intel security advisory INTEL-SA-01442 published