# CVE-2026-33197: AMI APTIOV input validation vulnerability in BIOS

Source: https://junglewise.ai/threats/cve-2026-33197-ami-aptiov-input-validation-vulnerability-in-bios  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-33197 · Severity: info · Published 2026-09-08

AMI APTIOV is firmware used in enterprise server BIOS. A privileged local user can exploit an input validation weakness to achieve arbitrary code execution, potentially compromising the confidentiality, integrity, and availability of the system and any data it processes.

Technologies: [AMI APTIOV](https://junglewise.ai/threats/technologies/aptiov). Vendors: [AMI](https://junglewise.ai/threats/vendors/ami).

## Quick answers

**Is CVE-2026-33197 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33197 being exploited in the wild.

**How severe is CVE-2026-33197?** Informational severity, published 8 September 2026.

**Which products and versions are affected?** AMI APTIOV.

**Is there a fix for CVE-2026-33197?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-33197 attacked?** It is attacked with local access, in device firmware.

**Am I affected by CVE-2026-33197?** Check whether you run AMI APTIOV. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an incomplete list of disallowed inputs (input validation weakness) in the BIOS component of AMI APTIOV firmware. It requires local access and elevated privileges to exploit. Successful exploitation allows an attacker to execute arbitrary code, affecting the entire system. The vulnerability was reported with info severity, though the stated impact suggests higher risk (arbitrary code execution affecting CIA triad). Patch availability has not been confirmed in the advisory text.

## Affected products

- AMI APTIOV

## Timeline

- 2026-09-08: disclosed

## References

- [https://go.ami.com/hubfs/Security%20Advisories/2026/AMI-SA-2026001.pdf](https://go.ami.com/hubfs/Security%20Advisories/2026/AMI-SA-2026001.pdf)

## Related threats

- [AMI APTIOV out-of-bounds write in BIOS](https://junglewise.ai/threats/cve-2026-66334-ami-aptiov-contains-vulnerabilities-in-bios-where-privileged)
- [AMI APTIOV out-of-bounds read in BIOS firmware](https://junglewise.ai/threats/cve-2026-66333-ami-aptiov-contains-vulnerabilities-in-bios-where-privileged)
- [AMI APTIOV out-of-bounds read in BIOS](https://junglewise.ai/threats/cve-2026-66332-ami-aptiov-contains-a-vulnerability-in-bios-where-a-privileged)
- [AMI APTIOV BIOS information disclosure](https://junglewise.ai/threats/cve-2026-0893-ami-aptiov-contains-a-vulnerability-in-bios-where-an-attacker-may)
- [AMI APTIOV buffer overflow in BIOS](https://junglewise.ai/threats/cve-2025-58774-ami-aptiov-contains-vulnerabilities-in-bios-where-users-may-cause)