30
VU#431093: TCG TPM 2.0 reference code found vulnerable to information leakage and timing side-channel attacks
CERT/CC discloses two TPM 2.0 reference code flaws allowing RSA key decryption and forged TPM attestations via crafted commands.
CERT/CC published VU#431093 covering two vulnerabilities in the TCG TPM 2.0 reference implementation: CVE-2026-6726 (information leakage via falsified TPM keys) and CVE-2026-6727 (timing side-channel in RSA OAEP decryption). An attacker with privileged access to a TPM command interface could send crafted TPM commands to decrypt ciphertexts for affected TPM-managed RSA keys, including the RSA Endorsement Key, or obtain credentials enabling forged TPM 2.0 attestations. Remediation is tracked in TCGVRT010 and TCGVRT0011.
55
47
47
30
35
35
35
35
60
35
55
55
47
47
30
47
35
60
60
Microsoft Fixes 80 Flaws — Including SMB PrivEsc and Azure CVSS 10.0 Bugs
60
55
30
30
VU#687587: AOMEI Backupper amwrtdrv.sys local privilege escalation vulnerability allows arbitrary writes to physical disks
AOMEI Backupper 8.4.0 driver flaw CVE-2026-12780 lets unprivileged users write physical disks and execute UEFI code, bypassing HVCI and EDR.
CERT/CC issued VU#687587 for CVE-2026-12780, an incorrect permission assignment (CWE-732) in the amwrtdrv.sys kernel driver shipped with AOMEI Backupper 8.4.0. The driver exposes a world-accessible device object without a security descriptor, allowing any unprivileged user to write arbitrary physical disk sectors; with Secure Boot disabled, an attacker can modify the GPT and inject a UEFI payload that executes before the OS loads, bypassing HVCI, EDR, Windows Defender and Hyper-V isolation. On TPM-only BitLocker configurations the attack can capture Volume Master Key material during pre-boot. AOMEI has shipped patches; users who cannot update should uninstall the software or disable the amwrtdrv.sys service, and enabling Secure Boot adds defense in depth.
62
30
55
30
60
35
55
30
30
35
30
42
55
60
35
55