CVE-2026-6726
HighCVSS 7.9Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
An information leakage vulnerability in the TCG TPM 2.0 reference code could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key and falsify other TPM 2.0 attestations with this key.
Risk Assessment
Risk of unauthorized credential acquisition and attestation forgery, undermining hardware trust.
Recommendation
Apply patches per TCG VRT0010 and monitor TPM key activities.
Original NVD description (English source)
An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key (such as an Attestation Key, DevID Key or TLS authentication key) and falsify other TPM 2.0 attestations with this key. See also TCG VRT0010.