Is CVE-2026-20901 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-20901 being exploited in the wild.

How severe is CVE-2026-20901?

Medium severity, with a CVSS score of 5.3, published 11 August 2026.

Which products and versions are affected?

Intel Xeon Scalable (4th Gen) CPU ID 806F7, 806F8; Intel Xeon Scalable (5th Gen) CPU ID C06F2; Intel Xeon W2400 CPU ID 806F8; Intel Xeon W3400 CPU ID 806F8; and 2 more.

Is there a fix for CVE-2026-20901?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-20901 attacked?

It is attacked with local access, in device firmware.

Am I affected by CVE-2026-20901?

Check whether you run Intel Xeon Scalable (4th Gen), Intel Xeon Scalable (5th Gen), Intel Xeon W2400 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-20901: Intel Xeon processors firmware improper input validation privilege escalation

CVE-2026-20901 · Severity: medium · CVSS 5.3 · Published 2026-08-11

Intel Xeon server processors contain a firmware vulnerability allowing privilege escalation through improper input validation in startup code and System Management Mode (SMM). An attacker with existing privileged access and local system access could modify system integrity through a complex attack, potentially compromising the security guarantees of the server platform.

Vendors: Intel.

Quick answers

Is CVE-2026-20901 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-20901 being exploited in the wild.
How severe is CVE-2026-20901?: Medium severity, with a CVSS score of 5.3, published 11 August 2026.
Which products and versions are affected?: Intel Xeon Scalable (4th Gen) CPU ID 806F7, 806F8; Intel Xeon Scalable (5th Gen) CPU ID C06F2; Intel Xeon W2400 CPU ID 806F8; Intel Xeon W3400 CPU ID 806F8; and 2 more.
Is there a fix for CVE-2026-20901?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-20901 attacked?: It is attacked with local access, in device firmware.
Am I affected by CVE-2026-20901?: Check whether you run Intel Xeon Scalable (4th Gen), Intel Xeon Scalable (5th Gen), Intel Xeon W2400 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper input validation flaw in Intel Xeon processor firmware, specifically affecting startup code and System Management Mode (SMM) execution paths. The vulnerability requires local access combined with privileged user context and high attack complexity; an adversary must have existing elevated privileges on the system. Exploitation allows data alteration and integrity compromise of the system, with CVSS score of 4.0 indicating medium severity with high integrity impact (SI:H). Intel recommends updating to the latest microcode versions provided by system manufacturers; patches were released with the advisory on 2026-08-11.

Affected products

Intel Xeon Scalable (4th Gen) CPU ID 806F7, 806F8
Intel Xeon W2400 CPU ID 806F8
Intel Xeon W3400 CPU ID 806F8
Intel Xeon Scalable (5th Gen) CPU ID C06F2
Intel Xeon6 (P-cores) CPU ID A06D0, A06D1, A06E0, A06E1
Intel Xeon6 SoC CPU ID A06E1

Timeline

2026-08-11: disclosed: Intel security advisory INTEL-SA-01442 published

References

https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01442.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.