CVE-2026-6726

An information-leakage flaw in the Trusted Computing Group's TPM 2.0 reference code (tracked by TCG as VRT0010 and by CERT/CC as VU#431093) allows a local attacker with elevated privileges to obtain a credential from a TPM-aware certificate authority for a falsified TPM key. It is triggered locally on systems whose TPM runs code derived from the TCG reference implementation when the attacker manipulates key-attestation flows for keys such as an Attestation Key, DevID Key, or TLS authentication key. With the fraudulently issued credential, the attacker can falsify other TPM 2.0 attestations with that key, undermining device-identity and attestation guarantees. Any deployment of the TCG TPM 2.0 reference code - including commercial TPM chips, firmware TPMs, and TPM-aware CA/attestation infrastructure - is potentially affected; the available data does not specify version ranges. No exploitation has been observed: there is no public proof-of-concept, the issue is not in CISA's KEV, and EPSS estimates only a ~0.2% chance of exploitation in the next 30 days.

What to do: Track TCG VRT0010/VU#431093 and apply TPM/BIOS firmware updates from your PC or TPM vendor as they become available; Microsoft's August 2026 Patch Tuesday batch (398 CVEs) is among related releases, so verify whether your platform's TPM fix shipped there. Prioritize environments that use TPM key attestation with a CA (EK/AK, DevID, or TLS client certificates) and restrict local administrative privileges until patched. Audit attestation credentials issued by TPM-aware CAs for keys that may have been falsified.