MITRE: CVE-2026-6726 TPM 2.0 Improper Object Slot Reuse

CVE-2026-6726 is a spoofing vulnerability in Windows TPM (rated Important, CVSS 7.9).

1 version

Microsoft id: CVE-2026-6726
Products: Windows TPM
Severity: Important
Impact: Spoofing
CVSS: 7.9
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C
Exploited: No
Publicly disclosed: No
Exploitability: Exploitation Less Likely
Customer action required: Yes
Release: 2026-Aug
Assigned by: MITRE
Weakness: CWE-843: Access of Resource Using Incompatible Type ('Type Confusion'), CWE-908: Use of Uninitialized Resource
MSRC revision: 1.0
First captured by us: 13 Nov 2026, 15:06 UTC (from our first import of this list)
Microsoft last modified: 11 Aug 2026, 14:00 UTC
Source: Security updates · open the original at Microsoft

Microsoft's revision notes

CVE-2026-6726 is a Spoofing vulnerability in the TPM 2.0 reference implementation involving improper object-slot reuse.

Security updates, 14:00 UTC, 11 Aug

One version so far. If Microsoft edits it, each change shows here with what was removed and added.

First version we captured · 15:06 UTC, 13 Nov
The text as we first saw it
Seen by us 15:06 UTC, 13 Nov · Microsoft's timestamp 14:00 UTC, 11 Aug · Microsoft's page

Last updated 13 Nov 2026, 15:06 UTC