CVE-2026-6727: CVE-2026-6727
Vulnerability summary
CVE-2026-6727 is a medium (CVSS 5.9) Observable Timing Discrepancy vulnerability in trusted computing group tpm2.0. EPSS estimates a 0.15% chance of exploitation in the next 30 days, higher than 4% of scored vulnerabilities.
Timeline
- 11-08-2026PublishedVulnerability first disclosed.
- 12-08-2026Last modifiedVulnerability information updated.
Description
A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys, including the RSA Endorsement Key (EK), including import blobs, credential blobs, and session salts. Under certain conditions, this may also enable the forgery of TPM 2.0 attestations. Refer to TCGVRT0011.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
- NVDNIST5.9MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
EPSS trend
Probability
0.15%
Chance of exploitation in the next 30 days
Percentile
4%
Versus all other CVEs
30-day change
Decrease -0.05 pp
From 0.20% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- libtpmsAll versions (No fix recorded)
Trusted computing group1 product
- tpm2.0≤ v184
Ubuntu1 product
- libtpmsAll versions (No fix recorded)
3 vendors · 3 products
