CVE-2026-6727

CVE-2026-6727 is a timing side-channel vulnerability (CWE-208, tracked as TCGVRT0011) in the RSA OAEP decryption implementation of TPM 2.0 code derived from the Trusted Computing Group reference implementation. A privileged local attacker with access to the TPM command interface can measure timing differences across decryption operations to recover information sufficient to decrypt ciphertexts encrypted to TPM-managed RSA keys, including the RSA Endorsement Key (EK), import blobs, credential blobs, and session salts. Under certain conditions, the leaked information may also enable forgery of TPM 2.0 attestations, undermining trust in remote-attestation results. Any platform whose TPM 2.0 firmware is built from the affected TCG reference code is potentially affected, which spans TPM silicon from multiple vendors shipped across modern PCs, laptops, and servers; per-vendor exposure depends on whether the vulnerable code path was adopted. No public proof-of-concept or known exploitation exists (EPSS 0.2% over 30 days, not in CISA KEV).

What to do: Inventory devices by TPM vendor/model and monitor for TPM firmware or driver fixes tied to TCGVRT0011 and VU#431093; apply updates from the device or silicon vendor as they are released, potentially surfacing through OS patch channels such as Microsoft's August 2026 Patch Tuesday. Until patched, restrict local privileged access to the TPM command interface to trusted code and weigh the risk of relying on TPM attestation for high-assurance operations. With no known exploitation and a high-complexity, local attack requirement, treat this as standard patch-cycle priority rather than an emergency.