Every CVE Search/ Get API key

CVE-2026-6726

An information leakage vulnerability in the TCG TPM 2.0 reference code.

7.9 HighFix available

CVE-2026-6726 is a high vulnerability (CVSS 7.9) in Trusted Computing Group Tpm2.0, published August 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. Fixed in libtpms 0.9.1-1.

An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key (such as an Attestation Key, DevID Key or TLS authentication key) and falsify other TPM 2.0 attestations with this key. See also TCG VRT0010.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.19%Unchanged since Aug 12, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.9

An information leakage vulnerability in the TCG TPM 2.0 reference code.

An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key (such as an Attestation Key, DevID Key or TLS authentication key) and falsify other TPM 2.0 attestations with this key. See also TCG VRT0010.

Record
CVE-2026-6726
CVSS 3.1
7.9 HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Weakness
CWE-704
Updated
2026-11-02
EUVDEUVD-2026-56224 7.9

An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key (such as an Attestation Key, DevID Key or TLS authentication key) and falsify other TPM 2.0 attestations with this key. See also TCG VRT0010.

Record
EUVD-2026-56224
CVSS 3.1
7.9 HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-72rq-994p-w2hw 7.9

An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could...

An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key (such as an Attestation Key, DevID Key or TLS authentication key) and falsify other TPM 2.0 attestations with this key. See also TCG VRT0010.

Record
GHSA-72rq-994p-w2hw
CVSS 3.1
7.9 HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Weakness
CWE-704
Updated
2026-11-02
NVD 7.9

An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key (such as an Attestation Key, DevID Key or TLS authentication key) and falsify other TPM 2.0 attestations with this key. See also TCG VRT0010.

Record
CVE-2026-6726
CVSS 3.1
7.9 HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Weakness
CWE-704
Updated
2026-11-02
OSVDEBIAN-CVE-2026-6726 7.9

An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key (such as an Attestation Key, DevID Key or TLS authentication key) and falsify other TPM 2.0 attestations with this key. See also TCG VRT0010.

Record
DEBIAN-CVE-2026-6726
CVSS 3.1
7.9 HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-6726 7.9

An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key (such as an Attestation Key, DevID Key or TLS authentication key) and falsify other TPM 2.0 attestations with this key. See also TCG VRT0010.

Record
UBUNTU-CVE-2026-6726
CVSS 3.1
7.9 HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libtpms
Debian:12
before 0.9.1-1
0.9.1-1
libtpms
Debian:13
before 0.9.1-1
0.9.1-1
libtpms
Debian:14
before 0.9.1-1
0.9.1-1

History

History
WhenChangedSources
2026-11-03affected
2026-11-02createdCVE List, EUVD, GitHub Advisories, NVD, OSV

References

MoveEnter Open