CVE-2026-20705

Awaiting Analysis Awaiting Analysis - Queue

Insecure Storage of Sensitive Data in Intel TDX Module

Publication date: 2026-08-11

Last updated on: 2026-08-31

Assigner: Intel Corporation

Description

Insecure storage of sensitive information in the Intel(R) TDX module for some Intel(R) platform within Ring 0: Trust Domain may allow information disclosure. System software adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (none) and availability (none) impacts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-31

Generated

2026-08-31

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-20705

EUVD

EUVD-2026-56471

Affected Vendors & Products

Vendor	Product	Version / Range
intel	tdx_module	to 1.5.28 (inc)
intel	tdx_module	to 2.0.16 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-922	The product stores sensitive information without properly limiting read or write access by unauthorized actors.

Attack-Flow Graph

Executive Summary

This vulnerability involves insecure storage of sensitive information in the Intel TDX module. A privileged system software adversary could exploit it to disclose data through a high-complexity local attack without requiring special internal knowledge or user interaction. The confidentiality impact is high, while integrity and availability are unaffected.

Detection Guidance

Detection requires specialized tools for Intel TDX module analysis. No standard commands are available due to the high complexity and privileged access requirements of this vulnerability. Contact Intel support for detection guidance.

Impact Analysis

If exploited, this vulnerability may allow an attacker to access sensitive data stored in the Intel TDX module. This could lead to unauthorized information disclosure, potentially compromising confidential or private data on the affected system.

Compliance Impact

This vulnerability could lead to data exposure, which may violate compliance requirements under GDPR, HIPAA, or other regulations that mandate protection of sensitive data. Organizations using affected Intel TDX systems may face legal and regulatory penalties due to potential data breaches.

Mitigation Strategies

Apply Intel-provided firmware updates immediately. Restrict privileged user access to Ring 0 environments. Monitor system logs for unusual activity in Trust Domain contexts. Disable unnecessary TDX features if not required.

Hi! I’m here to help you understand CVE-2026-20705. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70