Quick answers
- Is CVE-2026-20906 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-20906 being exploited in the wild.
- How severe is CVE-2026-20906?
- Informational severity, with a CVSS score of 5.4, published 11 August 2026.
- Which products and versions are affected?
- Intel Neural Compressor before v3.7.
- Is there a fix for CVE-2026-20906?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-20906 attacked?
- It is attacked with local access.
- Am I affected by CVE-2026-20906?
- Check whether you run Intel Neural Compressor at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This vulnerability is a protection mechanism failure affecting Intel Neural Compressor software before version 3.6, operating within Ring 3 (user-mode applications). The vulnerability allows unprivileged software with a privileged user to escalate privileges through a low-complexity local attack requiring passive user interaction. An attacker can achieve escalation of privilege, potentially impacting system confidentiality, integrity, and availability. Intel recommends updating to version 3.7 or later, with patches available at the official GitHub releases repository.
Affected products
- Intel Neural Compressor before v3.7
Timeline
- 2026-08-11: disclosed