CVE-2026-33197

Awaiting Analysis Awaiting Analysis - Queue

Privilege Escalation in AMI APTIOV BIOS

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: AMI

Description

AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Incomplete List of Disallowed Inputs” by local access. Successful exploitation of this vulnerability may lead to arbitrary code execution and impact system Confidentiality, Integrity, and Availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-33197

Affected Vendors & Products

Vendor	Product	Version / Range
ami	aptio	v*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-184	The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

Executive Summary

AMI APTIOV BIOS has a vulnerability where a privileged local user can exploit an incomplete list of disallowed inputs. This may allow arbitrary code execution and affect system confidentiality, integrity, and availability.

Impact Analysis

A successful exploit could let an attacker run arbitrary code on the system, potentially leading to unauthorized access, data theft, or system damage. This requires local privileged access.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating confidentiality and integrity requirements in GDPR and HIPAA. Compliance may be impacted if systems are not patched.

Mitigation Strategies

Update the AMI APTIOV BIOS to the latest version provided by AMI to address the vulnerability. Restrict physical and administrative access to systems to trusted users only to prevent exploitation.

Hi! I’m here to help you understand CVE-2026-33197. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70