CVE-2026-20885 is a high severity (CVSS 7.2 in the record) improper authentication flaw in the Intel TDX module, the component behind Trust Domain Extensions. It may allow information disclosure and privilege escalation by a privileged local adversary. Update the TDX module from your system manufacturer.
What's affected
Intel's advisory (INTEL-SA-01436) lists these TDX module versions as affected: 1.5.28 and earlier on 4th Gen and 5th Gen Intel Xeon Scalable, and 2.0.16 and earlier on Intel Xeon 6 with P-cores and Xeon 6 SoC. The record also names Xeon 6315P to 6353P parts.
The advisory lists no specific fixed version. It tells you to use the latest TDX module version from your system manufacturer.
Where the sources differ: the record scores it 7.2 (High) under CVSS 3.1, and Intel scores it 7.0 (High) under CVSS 4.0 with the vector CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N. Both land in High.
The weakness is CWE-287 (improper authentication). The description says a system software adversary with a privileged user and a high complexity attack, with attack requirements present, may succeed. KEV flag is false.
How to check if you're exposed
Work out whether you use TDX at all. It is a feature for confidential computing, so look at whether your hosts or cloud instances advertise Trust Domains. Then find the TDX module version, which your platform vendor reports in its firmware or hypervisor tooling. Compare it with 1.5.28 or 2.0.16 as appropriate. On Linux, read the BIOS or firmware version and date with:
sudo dmidecode -t bios
and the loaded microcode revision with:
grep -m1 microcode /proc/cpuinfo
Then compare them with the release notes from your server or board maker, since they package Intel's fixes into their own firmware. Intel's advisory does not give a single version number to look for. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers application dependencies, so it will not see operating system, firmware or driver issues like this one. For those, rely on your asset inventory and the vendor advisory.
What to do now
- Identify hosts with Intel TDX enabled, and the Xeon generation of each.
- Ask the system maker for the firmware that carries a newer TDX module.
- If you consume TDX as a cloud service, ask the provider for its patch status.
- Apply the firmware in a maintenance window and reboot.
- Re-check the module version, and re-run any attestation checks your workloads depend on.
- Restrict who holds privileged access on those hosts.
Why it matters
TDX exists to protect a virtual machine even from the host that runs it. CWE-287 (improper authentication) inside the TDX module matters because that module is the referee between the host and the protected guest. If the referee can be fooled, the guarantee that the host cannot see guest data weakens.
The flaw needs a privileged host side attacker and a hard to meet condition, so most ordinary workloads are not at stake. For teams who chose confidential computing precisely to resist a hostile administrator or provider, it is a flaw to take seriously and track to the vendor firmware.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need TDX enabled to be affected?
The advisory concerns the TDX module on listed platforms. If you do not use TDX, the practical exposure is lower, but follow your vendor's firmware guidance.
Where do fixes come from?
Intel says to use the latest TDX module from your system manufacturer. Cloud users should ask their provider.
Sources
Last reviewed: 18 October 2026.
