Two New Vulnerabilities Discovered in TPM 2.0 Reference Implementation

On August 11, 2026, two vulnerabilities were published affecting the TPM 2.0 reference implementation. CVE-2026-6726 is a spoofing vulnerability due to improper object-slot reuse, while CVE-2026-6727 is an information disclosure vulnerability linked to RSA OAEP timing side channels. Both vulnerabilities were assigned by MITRE on behalf of the Trusted Computing Group and impact Microsoft Windows systems. These vulnerabilities could potentially allow attackers to exploit the TPM 2.0 implementation, leading to unauthorized access or data leakage. Microsoft has released updates to address these vulnerabilities. Security professionals are advised to review the updates and apply necessary patches.

Key Points: • CVE-2026-6726 involves a spoofing vulnerability in TPM 2.0. • CVE-2026-6727 is an information disclosure vulnerability related to RSA OAEP timing. • Both vulnerabilities were published on August 11, 2026, and affect Microsoft Windows.