PatchaPalooza

CVE-2026-6727: MITRE: CVE-2026-6727 TPM 2.0 RSA OAEP Timing Side-Channel Vulnerability

CVE-2026-6727 is an information disclosure vulnerability in MITRE, rated Important by Microsoft, with a CVSS 3.1 base score of 5.9 (Medium). An attacker can exploit it by an attacker with local access, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.15% probability of exploitation activity in the next 30 days, higher than 4% of all scored vulnerabilities. Microsoft released the fix on 11 August 2026 in the August 2026 Patch Tuesday, delivered through 12 security updates (KB5120238, KB5120242, KB5120229, KB5123303 and more). It affects 30 products in 3 product families (Windows, ESU, Azure).

Key facts

CVE ID
CVE-2026-6727
Severity
Medium CVSS 5.9
Microsoft severity
Important
Impact
Information Disclosure
Exploited in the wild
No
Publicly disclosed
No
Exploitation likelihood
Less Likely
Weakness
CWE-208
EPSS
0.15% (percentile 4%)
CISA KEV
Not listed
Released
Last updated
Patch Tuesday
August 2026 Patch Tuesday
Product families
Windows, ESU, Azure

CVSS score and vector

Microsoft scores CVE-2026-6727 at 5.9 (temporal 5.2) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C

MetricValue
Attack vectorLocal
Attack complexityHigh
Privileges requiredNone
User interactionNone
ScopeChanged
Confidentiality impactHigh
Integrity impactNone
Availability impactNone
Exploit code maturityUnproven
Remediation levelOfficial fix
Report confidenceConfirmed

Description

CVE-2026-6727 is an Information Disclosure vulnerability in the TPM 2.0 reference implementation involving an RSA OAEP timing side channel. MITRE assigned this CVE on behalf of the Trusted Computing Group. This document incorporates updates to Microsoft Windows that address this vulnerability.

Please see CVE-2026-6727 for more information.

Frequently asked questions (Microsoft)

What type of information could be disclosed by this vulnerability

If the attacker has both the ability to modify the encrypted secret where it is stored and to observe the precise timing for the secret being decrypted by the application, the attacker could infer the original secret across many decryption attempts.

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to carefully time their actions to exploit the timing differences in the execution of specific operations. They must accurately measure these timing variations to infer sensitive information or gain unauthorized access. This often involves sophisticated techniques to manipulate and observe the timing behavior of the target system.

Do I need to do anything additional in order to be protected from this vulnerability?

Yes, you will need to install the following packages:

  • Windows Server 2022: KB5123303 (restart required)

Affected products (30)

Windows

ProductSecurity updateTypeFixed buildRestart
Windows 10 Version 1809 for 32-bit SystemsKB5120238Security Update10.0.17763.9121Yes
Windows 10 Version 1809 for x64-based SystemsKB5120238Security Update10.0.17763.9121Yes
Windows Server 2019KB5120238Security Update10.0.17763.9121Yes
Windows Server 2019 (Server Core installation)KB5120238Security Update10.0.17763.9121Yes
Windows Server 2022KB5120242
KB5120229
KB5123303		Security Update
Security Hotpatch Update
Security Update		10.0.20348.5499
10.0.20348.5440
10.0.20348.5499		Yes
Yes
Yes
Windows Server 2022 (Server Core installation)KB5120242
KB5120229
KB5123303		Security Update
Security Hotpatch Update
Security Update		10.0.20348.5499
10.0.20348.5440
10.0.20348.5499		Yes
Yes
Yes
Windows 10 Version 21H2 for 32-bit SystemsKB5120249Security Update10.0.19044.7663Yes
Windows 10 Version 21H2 for ARM64-based SystemsKB5120249Security Update10.0.19044.7663Yes
Windows 10 Version 21H2 for x64-based SystemsKB5120249Security Update10.0.19044.7663Yes
Windows Server 2025 (Server Core installation)KB5120233
KB5120228		Security Update
Security Hotpatch Update		10.0.26100.33296
10.0.26100.33222		Yes
Yes
Windows 11 Version 25H2 for ARM64-based SystemsKB5121003
KB5120994		Security Update
Security Hotpatch Update		10.0.26200.9168
10.0.26200.9106		Yes
Yes
Windows 11 Version 25H2 for x64-based SystemsKB5121003
KB5120994		Security Update
Security Hotpatch Update		10.0.26200.9168
10.0.26200.9106		Yes
Yes
Windows 11 Version 23H2 for ARM64-based SystemsKB5120240Security Update10.0.22631.7517Yes
Windows 11 Version 23H2 for x64-based SystemsKB5120240Security Update10.0.22631.7517Yes
Windows 11 Version 24H2 for ARM64-based Systems
Windows 11 Version 24H2 for x64-based Systems
Windows Server 2025KB5120233
KB5120228		Security Update
Security Hotpatch Update		10.0.26100.33296
10.0.26100.33222		Yes
Yes
Windows 11 version 26H1 for x64-based SystemsKB5121000Security Update10.0.28000.2704Yes
Windows 11 Version 26H1 for ARM64-based SystemsKB5121000Security Update10.0.28000.2704Yes
Windows 10 Version 1607 for 32-bit SystemsKB5120418Security Update10.0.14393.9418Yes
Windows 10 Version 1607 for x64-based SystemsKB5120418Security Update10.0.14393.9418Yes

ESU

ProductSecurity updateTypeFixed buildRestart
Windows 10 Version 22H2 for x64-based Systems
Windows 10 Version 22H2 for ARM64-based Systems
Windows 10 Version 22H2 for 32-bit Systems

Azure

ProductSecurity updateTypeFixed buildRestart
Azure Confidential Compute VM SKU DCasv5/DCadsv5
Azure Confidential Compute VM SKU ECasv5/ECadsv5
Azure Confidential Compute VM SKU DCasv6/DCadsv6
Azure Confidential Compute VM SKU ECasv6/ECadsv6
DCesv6-series Azure VM
Ecesv6-series Azure VM

Security updates (12)

NIST NVD data

NVD status
Awaiting Analysis
NVD CVSS
5.9 (MEDIUM)
NVD weakness
CWE-208
Published to NVD
NVD last modified

References

Revision history

VersionDateDescription
1.0Information published.

Sources