CVE-2026-39452 is a protection mechanism failure in Intel Transfer Learning Tool. The record scores it 7.3 (High) and says it allows privilege escalation over the network. Intel rates it 6.3 (Medium), and there is no fix: the product is discontinued, and Intel advises uninstalling it.
What's affected
Intel's advisory INTEL-SA-01499 lists all versions of Intel Transfer Learning Tool as affected. The CVE record says before version v0.7, but Intel says no updates are being released. Intel has issued a Product Discontinuation Notice, so the software no longer receives functional or security updates.
Source conflict to note: the record scores this 7.3 (High) with CVSS 3.1 and says versions before v0.7 are affected. Intel scores it 6.3 (Medium) with CVSS 4.0 and lists all versions as affected with no fixed release. Both are reported here, and Intel's guidance is to stop using the tool.
Weakness class: CWE-693, protection mechanism failure.
How to check if you're exposed
Search your machines, notebooks and container images for the Intel Transfer Learning Tool. Look through package lists, virtual environments, container images and requirements files for it. Your dependency inventory is the right place to find it, and the free in-browser dependency scan can read a manifest or lock file for you.
Also ask data science teams, since research tools are often installed once on a notebook server and never listed anywhere.
What to do now
- Find every installation of Intel Transfer Learning Tool across notebooks, servers, images and pipelines.
- Uninstall it, as Intel advises, and remove it from requirements files.
- Plan a replacement workflow using a maintained library if the tool was in real use.
- If it must stay for a short time, keep it off any network reachable by untrusted users.
- Add a rule to your inventory so discontinued products get flagged and not just vulnerable ones.
Why it matters
A protection mechanism failure means a safeguard the software relies on does not work as intended. The record says the flaw can be reached over the network by an unauthenticated attacker, with low impact on confidentiality, integrity and availability.
The lesson here is the lifecycle. When a vendor discontinues a product, every future flaw stays open. This advisory is an end of life notice as much as a patch notice. The KEV flag is false and Intel does not report exploitation. The right control is removal, and your dependency inventory is what tells you where it is.
Try it yourself
You cannot remove a tool you do not know you have. This demo shows how a dependency inventory is built.
Click through it at your own pace, or open it full screen.
Quick check
Is there a patch?
No. Intel says the product is discontinued and recommends uninstalling it.
Why do the scores differ?
The record gives 7.3 under CVSS 3.1 and Intel gives 6.3 under CVSS 4.0. The scoring versions weigh network attack requirements differently.
Sources
Last reviewed: 18 October 2026.
