CVE-2026-6726: MITRE: CVE-2026-6726 TPM 2.0 Improper Object Slot Reuse

Overview

Severity

High (CVSS 7.9)

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C

Category

Spoofing

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2026-Aug

Released

2026-08-11

EPSS Score

0.19% (percentile: 7.9%)

Description

CVE-2026-6726 is a Spoofing vulnerability in the TPM 2.0 reference implementation involving improper object-slot reuse. MITRE assigned this CVE on behalf of the Trusted Computing Group. This document incorporates updates to Microsoft Windows that address this vulnerability. Please see CVE-2026-6726 for more information.

FAQ

Do I need to do anything additional in order to be protected from this vulnerability? Yes, you will need to install the following packages: Windows 11 Enterprise, versions 25H2 and 24H2: KB5123607 Windows 11 Enterprise, versions 25H2 and 24H2 — Additional update for devices where the Pluton security processor has been configured as the TPM: KB5123273 (restart required) Windows Server 2022: KB5123303 (restart required)

Affected Products (30)

Windows

• Windows 10 Version 1809 for 32-bit Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows Server 2019
• Windows Server 2019 (Server Core installation)
• Windows Server 2022
• Windows Server 2022 (Server Core installation)
• Windows 10 Version 21H2 for 32-bit Systems
• Windows 10 Version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for x64-based Systems
• Windows Server 2025 (Server Core installation)
• Windows 11 Version 25H2 for ARM64-based Systems
• Windows 11 Version 25H2 for x64-based Systems
• Windows 11 Version 23H2 for ARM64-based Systems
• Windows 11 Version 23H2 for x64-based Systems
• Windows 11 Version 24H2 for ARM64-based Systems
• Windows 11 Version 24H2 for x64-based Systems
• Windows Server 2025
• Windows 11 version 26H1 for x64-based Systems
• Windows 11 Version 26H1 for ARM64-based Systems
• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 Version 1607 for x64-based Systems

ESU

• Windows 10 Version 22H2 for x64-based Systems
• Windows 10 Version 22H2 for ARM64-based Systems
• Windows 10 Version 22H2 for 32-bit Systems

Azure

• Azure Confidential Compute VM SKU DCasv5/DCadsv5
• Azure Confidential Compute VM SKU ECasv5/ECadsv5
• Azure Confidential Compute VM SKU DCasv6/DCadsv6
• DCesv6-series Azure VM
• Azure Confidential Compute VM SKU ECasv6/ECadsv6
• Ecesv6-series Azure VM

Security Updates (14)

• 5120238
• 5120242
• 5120229
• 5123303
• 5120249
• 5120233
• 5120228
• 5121003
• 5120994
• 5123607
• 5123273
• 5120240
• 5121000
• 5120418

Acknowledgments

Anonymous

Revision History

• 2026-08-11: Information published.