CVE-2026-20898 is a high severity improper access control flaw in the firmware of the Alias Checking Trusted Module (ACTM) on some Intel Xeon processors. The record scores it 7.2, and Intel scores it 8.5. It may allow privilege escalation by a privileged local attacker. Intel is releasing firmware updates through system makers.
What's affected
Intel's advisory (INTEL-SA-01439) covers 4th Gen and 5th Gen Xeon Scalable, Xeon 6 with P-cores, Xeon 6 SoC and Xeon 6 with E-cores, identified by CPU ID and platform ID. For example, 4th Gen parts with CPU IDs 806F7 and 806F8, and Xeon 6 with P-cores with A06D0, A06D1, A06E0 and A06E1. The record names Xeon 6315P, 6325P, 6333P and 6337P and their firmware.
The advisory gives no fixed firmware numbers. Intel recommends that users of the ACTM module update to the latest version from their system manufacturer.
Where the sources differ: the record scores it 7.2 (High) under CVSS 3.1. Intel scores it 8.5 (High) under CVSS 4.0 with the vector CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N. That is a bigger gap than usual, mostly because CVSS 4.0 counts impact on other systems. The weakness is CWE-284 (improper access control). The attacker model is startup code and SMM, with a privileged user and a high complexity attack. KEV flag is false.
How to check if you're exposed
Match your CPU's family, model and stepping against the CPU ID list in Intel's advisory. On Linux, grep -m1 -E 'cpu family|model|stepping' /proc/cpuinfo is a start, though the advisory's CPU ID format needs translation, so use your vendor's tooling if unsure. On Linux, read the BIOS or firmware version and date with:
sudo dmidecode -t bios
and the loaded microcode revision with:
grep -m1 microcode /proc/cpuinfo
Then compare them with the release notes from your server or board maker, since they package Intel's fixes into their own firmware. Intel's advisory does not give a single version number to look for. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan covers application dependencies, so it will not see operating system, firmware or driver issues like this one. For those, rely on your asset inventory and the vendor advisory.
What to do now
- Inventory Xeon servers by generation and CPU ID.
- Obtain the vendor firmware that includes Intel's ACTM update.
- Test on a non-production host first.
- Deploy through your regular firmware maintenance process.
- Verify the new firmware version after reboot.
- Keep firmware update paths locked down. This flaw sits in code that runs early in boot, so protect who can flash firmware.
Why it matters
CWE-284 (improper access control) in early boot firmware is a different risk than a bug in an application. Startup code and System Management Mode run beneath the operating system, so an attacker who gets there can sit out of reach of normal security tools. The record puts high confidentiality and integrity impact on the system.
The attacker needs privileges already and a hard to meet condition, so this is not an entry point. It is a way to dig in deeper. Fleet owners who care about firmware integrity should treat the update as part of regular hardening, and plan for the vendor release cycle, which is usually slower than an operating system patch.
Quick check
Why does Intel score this higher than the record?
Intel uses CVSS 4.0 and counts impact on subsequent systems. The record uses CVSS 3.1. Both call it High.
Is a firmware version number listed?
Not in the page we read. Ask your system manufacturer which release carries the fix.
Sources
Last reviewed: 18 October 2026.
