Many systems with processors from AMD and Intel are vulnerable through a common component: the Trusted Platform Module, which runs as firmware on an isolated microcontroller core in modern processors (fTPM 2.0). The industry consortium Trusted Computing Group provides fTPM 2.0 reference code, which AMD and Intel, among others, integrate into their BIOS versions. Both companies are part of the group.
Earlier reference code had serious flaws, which the Trusted Computing Group itself reported. This results in two security vulnerabilities: CVE-2026-6726 and CVE-2026-6727 . In the widely used Common Vulnerability Scoring System (CVSS), the vulnerabilities have high severity scores of 8.5 and 8.3.
A Trusted Platform Module is at the beginning of the trust chain (Root of Trust) for servers, desktop PCs, and notebooks. Cryptographic keys are stored in the TPM, and by comparing these keys, systems can ensure, for example, the authenticity of the installed UEFI BIOS. Windows uses the TPM for Bitlocker encryption. Security vulnerabilities allow deep-seated changes to the system.
The good news: Local access with privileged rights is necessary for exploitation. This makes the security vulnerabilities of little concern to private users. They are relevant, for example, in companies: attackers could compromise a notebook, present it as a secure company device, and thus infiltrate the entire corporate network.
CVE-2026-6727 is a side-channel attack that can read secrets from the TPM via timing differences. A prepared software sends countless commands to the co-processor and measures the time the system takes to respond. The program fills the blocks of the encryption method used, RSA-OAEP. Correct and incorrect padding values yield different response times, allowing information to be extracted.
CVE-2026-6726 bypasses the verification of the stored cryptographic keys. Under certain circumstances, a TPM does not correctly invalidate discarded keys, allowing attackers to present a new false key at the same address as genuine. This, in turn, allows for deep manipulation of the system.
For AMD, all desktop, notebook, and embedded processors with Zen architecture are affected, from Ryzen 1000 to Ryzen 9000 or Ryzen AI 400 ( Security Bulletin ). For server models, AMD lists only the smaller desktop siblings Epyc 4004 and Epyc 4005, but not the multi-core processors designated 7000 and 9000.
For Intel, desktop, notebook, and embedded processors up to and including the Core Ultra 200 series are affected ( Security Bulletin 1 , 2 ). For server models, Intel names series up to the third-generation Xeon Scalable (Ice Lake) from 2021.
Both AMD and Intel have already distributed new firmware versions to manufacturers of desktop PCs, notebooks, and motherboards, who will offer corresponding BIOS updates over the weeks and months. At the same time, software patches are also being released, for example for the Debian library libtpms and numerous Windows versions .
This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
