CVE-2026-40668: Medium severity AMD Secure Encrypted Virtualization (SEV) firmware vulnerability

Published Nov 10, 2026

Updated

Authentication bypass by spoofing in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to request attestation reports for VMPL 0.

Affected Software

1 affected component

AMD Secure Encrypted Virtualization (SEV) firmware

Event History

Nov 10, 2026

CVE Published

via MITRE·10:11 PM

Data Sourced

via MITRE·10:11 PM

DescriptionWeakness

Data Sourced

via NVD·10:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who needs to be considered an attacker for this issue?

The attacker is a malicious hypervisor. Exploitation requires high privileges on the local system, as reflected by the PR:H and AV:L metrics.

What can a successful attacker obtain?

A malicious hypervisor could request attestation reports for VMPL 0. The provided impact metrics indicate a low subsequent-system integrity impact and no stated confidentiality or availability impact.

CVE-2026-40668: Medium severity AMD Secure Encrypted Virtualization (SEV) firmware vulnerability

Affected Software

Event History

Frequently Asked Questions

Who needs to be considered an attacker for this issue?

What can a successful attacker obtain?

Company

Resources

Contact

Frequently Asked Questions

Who needs to be considered an attacker for this issue?

What can a successful attacker obtain?