CVE-2026-20716 is a high severity (CVSS 7.0 in the record) improper access control flaw in some Intel Xeon 6 processors. It may allow privilege escalation from user applications on a system where an attacker has local access and special knowledge. Intel is releasing microcode, so install the updated firmware or BIOS from your system maker.
What's affected
Intel's advisory (INTEL-SA-01435) lists Intel Xeon 6 processors with P-cores (Server), Xeon 6 SoC, and Xeon 6 (Workstation). The record names Xeon 6315P, 6325P, 6333P and 6337P parts along with their firmware.
The advisory does not give specific fixed version numbers. It says Intel is releasing microcode updates and recommends installing the latest firmware or BIOS from your system manufacturer.
Where the sources differ: the NVD record scores it 7.0 (High) under CVSS 3.1. Intel scores it 7.2 (High) under CVSS 4.0, with the vector CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N. Both are High, and the gap is only the scoring version.
The weakness is CWE-284 (improper access control). The description mentions a simple hardware adversary with an authenticated user and a high complexity attack, local access, and special internal knowledge. KEV flag is false.
How to check if you're exposed
First find out whether you run an affected Xeon 6 system. The model string appears in the output of lscpu on Linux or in System Information on Windows. On Linux, read the BIOS or firmware version and date with:
sudo dmidecode -t bios
and the loaded microcode revision with:
grep -m1 microcode /proc/cpuinfo
Then compare them with the release notes from your server or board maker, since they package Intel's fixes into their own firmware. Intel's advisory does not give a single version number to look for. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers application dependencies, so it will not see operating system, firmware or driver issues like this one. For those, rely on your asset inventory and the vendor advisory.
What to do now
- Inventory servers and workstations with Intel Xeon 6 processors.
- Ask each hardware vendor for the firmware or BIOS release that carries Intel's microcode for this advisory.
- Stage it on a test node and check that virtualization and storage behave normally.
- Roll it through production in your usual maintenance windows.
- Confirm the BIOS or microcode revision after reboot.
- Limit local and physical access to these machines in the meantime, since the attack needs it.
Why it matters
CWE-284 (improper access control) at the processor level means a protection that should keep a user mode program out of something sensitive has a gap. The description puts the weak point at Ring 3, which is where ordinary applications run. The impact it names is high confidentiality and high integrity on the vulnerable system.
The bar is high: local access, a hard to meet condition, and inside knowledge. That is why this is a patch in the normal cycle for most fleets. Where it matters more is shared hosts, such as multi-tenant servers, where one untrusted local user is part of the design.
Quick check
Can I fix this from the operating system?
Intel says it is releasing microcode, which usually ships through a BIOS or firmware update from the system maker, and sometimes through OS microcode packages. Check your vendor.
Is a version number given?
Not in the advisory page we read. Follow your system manufacturer's guidance.
Sources
Last reviewed: 18 October 2026.
