Loading story…
Intel disclosed and patched several vulnerabilities affecting Intel Xeon server processors, including firmware and trusted execution flaws that can lead to local privilege escalation and, in one case, denial of service. In advisory INTEL-SA-01313, Intel said CVE-2025-20053 and CVE-2025-24305 affect multiple Xeon families, including 4th and 5th Gen Xeon Scalable, Xeon W2400/W3400, and some Xeon 6 products, with the bugs tied to SGX buffer handling and ACTM firmware control flow. Intel also noted CVE-2025-21090 as a local denial-of-service issue and said the vulnerabilities were discovered internally, with mitigations delivered through firmware updates from system manufacturers.
Intel separately issued INTEL-SA-01367 for Xeon 6 Birch Stream processors, covering CVE-2025-26403 and CVE-2025-32086, two high-severity flaws that affect systems using SGX or TDX and could let a privileged local user escalate privileges through out-of-bounds writes or improper security checks. Related reporting also highlighted additional Xeon 6 risks involving OOB-MSM access control (CVE-2025-22839), TDX memory-range overlap handling (CVE-2025-22889), and instruction-sequence-triggered privilege escalation (CVE-2025-22840), underscoring continued exposure in confidential computing and hardware management features. Intel released microcode and firmware mitigations and advised customers to install the latest updates from their OEM or system vendor.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
F5 issued a product advisory concerning Intel UEFI firmware vulnerability CVE-2025-20105. No further details are provided in the reference synopsis.
HPE published advisory HPESBHF05019 rev.1 for certain HPE SimpliVity servers using certain Intel processors, referencing INTEL-SA-01397 and multiple vulnerabilities involving the 2026.1 IPU and Intel Trust Domain Extensions module. The reference indicates an HPE product impact and vendor response distinct from the previously listed Intel and F5 advisories.
Intel disclosed CVE-2025-26403 and CVE-2025-32086 affecting some Intel Xeon 6 processors when SGX or TDX is in use. Intel rated both issues High under CVSS v3.1, released microcode updates, and said a Trusted Computing Base recovery was planned after public disclosure.
Intel disclosed three vulnerabilities affecting several Intel Xeon processor families: CVE-2025-20053, CVE-2025-24305, and CVE-2025-21090. Intel said the issues were discovered internally and released firmware mitigations through system manufacturers.
Intel disclosed CVE-2025-20037, a TOCTOU race condition in Intel Converged Security and Management Engine firmware, and released patched firmware versions 16.1.38.2676 and 14.1.77.2497. The flaw could enable privilege escalation or security control bypass on affected Intel-based systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
14 references tracked. Mallory keeps watching after this page renders.
my.f5.com
Open sourcesupport.hpe.com
Open sourceintel.com
Open sourceintel.com
Open sourcezeropath.com
Open sourcezeropath.com
Open sourcezeropath.com
Open sourcecyber.ee
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Intel disclosed multiple vulnerabilities in Linux kernel-mode Ethernet drivers for its **700 Series**, **800 Series**, and **I350 Series** network adapters, warning that authenticated local users could exploit the flaws for **privilege escalation**, **information disclosure**, or **denial of service**. The most severe issue listed in `INTEL-SA-01296` is **CVE-2025-24325**, rated **CVSS 4.0 9.3 Critical**, affecting some Intel 800 Series Ethernet drivers before version `1.17.2`; Intel said the advisory covers eight CVEs tied to improper input validation, insufficient control flow management, exceptional-condition handling, and integer overflow. A separate advisory, `INTEL-SA-01335`, covers Intel 700 Series and I350 Series Linux drivers, including 700 Series flaws such as **CVE-2025-24486**, **CVE-2025-21086**, and **CVE-2025-25273**, which can expose vulnerable kernel code paths in the `i40e` driver and potentially lead to root-level compromise on affected Linux systems. Intel said affected 700 Series driver versions earlier than `2.28.5` and I350 Series driver versions earlier than `5.19.2` should be upgraded, while 800 Series deployments should move to `1.17.2` or later; fixes are also available through the **Intel Ethernet Adapter Complete Driver Pack** version `30.0.1` or later. The impacted hardware spans widely deployed enterprise and cloud platforms, including Intel **I710**, **X710**, **XL710**, **XXV710**, **V710**, **X722**, and multiple Xeon- and Atom-based systems. Intel said the vulnerabilities were discovered internally and released under coordinated disclosure after mitigations became available, and public reporting indicated no proof-of-concept exploit had been released for the highlighted 700 Series issues at the time of publication.
Jun 29, 2026
Intel, Microsoft, VMware, Xen, and Linux maintainers published mitigation guidance for **Downfall** / **Gather Data Sampling (GDS)**, a transient execution side-channel vulnerability tracked as **`CVE-2022-40982`** that affects multiple Intel processor generations from **Skylake through Tiger Lake/Ice Lake-era parts**. Research by Google’s Daniel Moghimi showed the flaw can leak sensitive data across security boundaries—including processes, the kernel, virtual machines, sibling threads, and some trusted execution environments—by abusing speculative execution of **gather** instructions to expose stale vector register contents. Reported impacts include theft of passwords, encryption keys, SGX-protected data, and other memory-derived secrets, with shared and cloud environments highlighted as particularly exposed. Intel said mitigation relies primarily on updated **microcode** that blocks transient results of gather instructions from being observed speculatively, while Microsoft directed Windows customers to obtain Intel platform updates from OEMs and noted the protection is enabled by default. VMware said hypervisor patches are generally not required if underlying firmware is updated, while Xen issued advisory **XSA-435** and stable-tree fixes plus options such as restricting **AVX** for untrusted guests. Intel and downstream guidance warned that mitigation can carry noticeable performance costs—minimal for many workloads but up to **50%** for gather-heavy applications—and added that newer Intel families such as **Alder Lake, Raptor Lake, and Sapphire Rapids** include protections and are not considered affected.
Jun 29, 2026
Researchers and industry reporting revealed that Intel processors were affected by a broader set of speculative-execution vulnerabilities beyond the original **Meltdown** and **Spectre** disclosures, including eight additional issues dubbed **Spectre-NG**. Several of the newly reported flaws were described as high risk, with at least one capable of crossing virtual machine boundaries and threatening cloud environments by exposing sensitive data such as passwords and cryptographic keys; reports also said Intel **SGX** protections were not sufficient against some of these attacks. The wider Spectre/Meltdown family affected Intel most heavily for Meltdown and Intel, AMD, and Arm for Spectre, reinforcing warnings that complete remediation would ultimately require hardware changes rather than software alone.
Jun 29, 2026