Quick answers
- Is CVE-2026-6484 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-6484 being exploited in the wild.
- How severe is CVE-2026-6484?
- High severity, with a CVSS score of 8.2, published 12 August 2026.
- Which products and versions are affected?
- InsydeH2O Multiple versions affected; patched versions available for various Intel platforms (Alder Lake, Raptor Lake, Arrow Lake, Meteor Lake, Elkhart Lake, and others).
- Is there a fix for CVE-2026-6484?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-6484 attacked?
- It is attacked with local access, in device firmware.
- Am I affected by CVE-2026-6484?
- Check whether you run InsydeH2O at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This vulnerability is a lack of verified boot (CWE-1277: Insufficient Verification of Data Authenticity in Firmware) in certain firmware volumes (FV) within the UEFI implementation. The attack requires high privilege access (PR:H) and does not require user interaction. An attacker with sufficient privileges can bypass secure boot verification on affected firmware versions, leading to arbitrary code execution during the boot phase. The issue affects multiple Intel processor families and InsydeH2O firmware; patched versions are available from Insyde Software.
Affected products
- Insyde InsydeH2O Multiple versions affected; patched versions available for various Intel platforms (Alder Lake, Raptor Lake, Arrow Lake, Meteor Lake, Elkhart Lake, and others)
Timeline
- 2026-08-11: disclosed
- 2026-08-12: advisory: CVE-2026-6484 published