1. Home
  2. CVE Database
  3. CVE-2026-20901
MEDIUM · 5.3

CVE-2026-20901

Improper input validation for some Intel(R) Xeon(R) processors within firmware may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexi...

Vulnerability Description

Improper input validation for some Intel(R) Xeon(R) processors within firmware may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable data alteration. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and availability (none) impacts.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality
NONE
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
IntelXeon Bronze 3408U Firmware-
IntelXeon Bronze 3408U-
IntelXeon Gold 5403N Firmware-
IntelXeon Gold 5403N-
IntelXeon Gold 5411N Firmware-
IntelXeon Gold 5411N-
IntelXeon Gold 5412U Firmware-
IntelXeon Gold 5412U-
IntelXeon Gold 5415\+ Firmware-
IntelXeon Gold 5415\+-
IntelXeon Platinum 8592\+ Firmware-
IntelXeon Platinum 8592\+-
IntelXeon Platinum 8592V Firmware-
IntelXeon Platinum 8592V-
IntelXeon Platinum 8593Q Firmware-
IntelXeon Platinum 8593Q-
IntelXeon Silver 4509Y Firmware-
IntelXeon Silver 4509Y-
IntelXeon Silver 4510 Firmware-
IntelXeon Silver 4510-

Related Weaknesses (CWE)

CWE-20

References

FAQ

What is CVE-2026-20901?

CVE-2026-20901 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Improper input validation for some Intel(R) Xeon(R) processors within firmware may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexi...

How severe is CVE-2026-20901?

CVE-2026-20901 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-20901?

Check the references section above for vendor advisories and patch information. Affected products include: Intel Xeon Bronze 3408U Firmware, Intel Xeon Bronze 3408U, Intel Xeon Gold 5403N Firmware, Intel Xeon Gold 5403N, Intel Xeon Gold 5411N Firmware.