MITRE: CVE-2026-6727 TPM 2.0 RSA OAEP Timing Side-Channel Vulnerability
CVE-2026-6727 is an information disclosure vulnerability in Windows TPM (rated Important, CVSS 5.9).
1 version
Facts
- Microsoft id
CVE-2026-6727- Products
- Windows TPM
- Severity
- Important
- Impact
- Information Disclosure
- CVSS
- 5.9
- CVSS vector
- CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
- Exploited
- No
- Publicly disclosed
- No
- Exploitability
- Exploitation Less Likely
- Customer action required
- Yes
- Release
- 2026-Aug
- Assigned by
- MITRE
- Weakness
- CWE-208: Observable Timing Discrepancy
- MSRC revision
- 1.0
- First captured by us
- (from our first import of this list)
- Microsoft last modified
- Source
- Security updates · open the original at Microsoft
Microsoft's revision notes
- Revision 1.0, 2026-08-11:
Information published.
Microsoft says
CVE-2026-6727 is an Information Disclosure vulnerability in the TPM 2.0 reference implementation involving an RSA OAEP timing side channel.
What Microsoft changed
One version so far. If Microsoft edits it, each change shows here with what was removed and added.
First version we captured ·
The text as we first saw it
Seen by us · Microsoft's timestamp · Microsoft's page
Related changes
Mentioning the same Microsoft ids
Last updated