Is CVE-2026-6923 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6923 being exploited in the wild.

How severe is CVE-2026-6923?

Low severity, with a CVSS score of 3.8, published 14 May 2026.

Which products and versions are affected?

Generic Trusted Platform Module (TPM).

Is there a fix for CVE-2026-6923?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-6923 attacked?

It is attacked with physical access, in device firmware.

Am I affected by CVE-2026-6923?

Check whether you run Generic Trusted Platform Module (TPM). Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6923: Generic TPM side-channel key extraction in ECDH operations

CVE-2026-6923 · Severity: low · CVSS 3.8 · Published 2026-05-14

A security vulnerability exists in certain hardware security chips (TPMs) used to protect sensitive cryptographic keys on computers. An attacker with physical access to the device could potentially use specialized equipment to monitor the chip's activity and steal private encryption keys. This could allow an unauthorized person to decrypt sensitive data or impersonate the device, though the attack is difficult to perform and requires high-level access.

Vendors: Generic.

Quick answers

Is CVE-2026-6923 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6923 being exploited in the wild.
How severe is CVE-2026-6923?: Low severity, with a CVSS score of 3.8, published 14 May 2026.
Which products and versions are affected?: Generic Trusted Platform Module (TPM).
Is there a fix for CVE-2026-6923?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-6923 attacked?: It is attacked with physical access, in device firmware.
Am I affected by CVE-2026-6923?: Check whether you run Generic Trusted Platform Module (TPM). Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A side-channel vulnerability (CWE-1300) exists in TPM hardware during the processing of Elliptic Curve Diffie-Hellman (ECDH) operations. The flaw allows an attacker with physical access to the hardware to monitor physical emissions (such as electromagnetic leaks or power consumption) to reconstruct private keys. Exploitation requires high privileges, physical proximity, and high technical complexity to bypass existing protections. Successful exploitation results in a loss of confidentiality for the stored ECDH keys, potentially compromising encrypted communications or identity secrets protected by the TPM.

Affected products

Generic Trusted Platform Module (TPM)

Timeline

2026-05-14: disclosed: Initial disclosure by Israel National Cyber Directorate
2026-05-14: advisory: NVD publication date

References

https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.