CVE-2025-35990

Assessment

Why it matters

EPSS is 0.2%; technical severity is CVSS 8.7.

Improper input validation for some Intel Endpoint Management Assistant (EMA) software before version 1.14.5 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Who should care

• Teams operating Endpoint Management Assistant
• Vulnerability and exposure management teams
• Security operations teams monitoring exploitation activity

Response plan

What I would do

1. Confirm whether Endpoint Management Assistant is present in the environment.
2. Identify affected versions and establish whether vulnerable services are exposed or reachable.
3. Intel Security patch Intel Sa 01434
4. Review relevant security telemetry for evidence of attempted or successful exploitation.
5. Document the remediation decision and track it to verified completion.

Technical details

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CWE

CWE-20

Affected versions

Intel Endpoint Management Assistant (End Excluding 1.14.5.0)

Fixed versions

Intel Endpoint Management Assistant (Fixed from 1.14.5.0)

Published

12 May 2026

Attack vector

Adjacent

Privileges required

None

User interaction

None

Signal timeline

1. 12 May 2026CVE published
2. 20 Aug 2026Latest EPSS score: 0.2%
3. 19 Aug 2026 · 13:52 UTCSignal calculated at 13