CVE-2026-6727 MITRE: CVE-2026-6727 TPM 2.0 RSA OAEP Timing Side

Api.Msrc.Microsoft • August 11, 2026

[CVE-2026-6727]( is an Information Disclosure vulnerability in the TPM 2.0 reference implementation involving an RSA OAEP timing side channel. MITRE assigned this CVE on behalf of the Trusted Computing Group. This document incorporates updates to Microsoft Windows that address this vulnerability.

Please see [CVE-2026-6727]( for more information.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Two New Vulnerabilities Discovered in TPM 2.0 Reference Implementation On August 11, 2026, two vulnerabilities were published affecting the TPM 2.0 reference implementation. CVE-2026-6726 is a spoofing vulnerability due to improper object-slot reuse, while CVE-2026-6727 is an information disclosure vulnerability linked to RSA OAEP timing side channels. Both vulnerabilities were assigned by MITRE on behalf of the Trusted Computing Group and impact Microsoft Windows systems. These vulnerabilities could potentially allow attackers to exploit the TPM 2.0 implementation, leading to unauthorized access or data leakage. Microsoft has released updates to address these vulnerabilities. Security professionals are advised to review the updates and apply necessary patches. 2 sources 58

Extracted Entities

CVE-2026-6727 MITRE: CVE-2026-6727 TPM 2.0 RSA OAEP Timing Side

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)