Many systems with processors from AMD and Intel are vulnerable through a common component: the Trusted Platform Module, which runs as firmware on an isolated microcontroller core in modern processors (fTPM 2.0). The industry consortium Trusted Computing Group provides fTPM 2.0 reference code, which AMD and Intel, among others, integrate into their BIOS versions. Both companies are part of the group.
Earlier reference code had serious flaws, which the Trusted Computing Group itself reported. This results in two security vulnerabilities: CVE-2026-6726 and CVE-2026-6727. In the widely used Common Vulnerability Scoring System (CVSS), the vulnerabilities have high severity scores of 8.5 and 8.3.
A Trusted Platform Module is at the beginning of the trust chain (Root of Trust) for servers, desktop PCs, and notebooks. Cryptographic keys are stored in the TPM, and by comparing these keys, systems can ensure, for example, the authenticity of the installed UEFI BIOS. Windows uses the TPM for Bitlocker encryption. Security vulnerabilities allow deep-seated changes to the system.
High Hurdles for Attackers
The good news: Local access with privileged rights is necessary for exploitation. This makes the security vulnerabilities of little concern to private users. They are relevant, for example, in companies: attackers could compromise a notebook, present it as a secure company device, and thus infiltrate the entire corporate network.
