CVE-2026-20763

Assessment

Why it matters

EPSS is 0.1%; technical severity is CVSS 4.6.

Incorrect calculation for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Who should care

• Teams operating Trust Domain Extensions Guest
• Vulnerability and exposure management teams
• Security operations teams monitoring exploitation activity

Response plan

What I would do

1. Confirm whether Trust Domain Extensions Guest is present in the environment.
2. Identify affected versions and establish whether vulnerable services are exposed or reachable.
3. Vendor advisory from intel.com
4. Review relevant security telemetry for evidence of attempted or successful exploitation.
5. Document the remediation decision and track it to verified completion.

Technical details

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CWE

CWE-682

Affected versions

Intel Trust Domain Extensions Guest (End Excluding 0.3.1)

Fixed versions

Intel Trust Domain Extensions Guest (Fixed from 0.3.1)

Published

11 August 2026

Attack vector

Local

Privileges required

High

User interaction

None

Signal timeline

1. 11 Aug 2026CVE published
2. 20 Aug 2026Latest EPSS score: 0.1%
3. 19 Aug 2026 · 13:56 UTCSignal calculated at 8

External references

• Intel Technical reference Intel Sa 01462 ↗