4.0
Medium
CVE-2026-20901 Improper input validation for some Intel(R) Xeon(R) processors within firmware may allow an escalation of privilege
Description
Improper input validation for some Intel(R) Xeon(R) processors within firmware may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable data alteration. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and availability (none) impacts.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Intel(R) Xeon(R) Processors | Versions not published |
Other CVEs of Intel(R) Xeon(R) Processors
The 8 CVEs of Intel(R) Xeon(R) Processors →
CVE-2025-24305
Insufficient control flow management in the Alias Checking Trusted Module (ACTM) firmware for some Intel(R) Xeon(R)…
7.2
High
CVE-2025-21090
Missing reference to active allocated resource for some Intel(R) Xeon(R) processors may allow an authenticated user to…
6.5
Medium
CVE-2024-37020
Sequence of processor instructions leads to unexpected behavior in the Intel(R) DSA V1.0 for some Intel(R) Xeon(R)…
3.8
Low
CVE-2024-25565
Insufficient control flow management in UEFI firmware for some Intel(R) Xeon(R) Processors may allow an authenticated…
3.8
Low