Intel and AMD Patch Tuesday: over 200 vulnerabilities fixed across more than 50 advisories, some mitigations still pending
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 13/11/2026 00:05; os links antigos trazem para cá.
On November 10, 2026, Intel and AMD published more than 50 security advisories covering over 200 vulnerabilities (securityweek.com). Intel's advisories address over 100 flaws, including critical privilege escalation and remote code execution issues, while AMD's bulletins detail around 100 CVEs, many affecting graphics and firmware (securityweek.com). On November 12, CERT-FR issued its own advisory on the Intel bulletins. It warns that the flaws could allow arbitrary code execution, privilege escalation, breaches of data confidentiality and bypass of security policies (cert.cyber.gouv.fr). Not every issue has a patch yet: some AMD mitigations are delayed, and one discontinued Intel product will not be patched (securityweek.com). Neither source reports exploitation in the wild.
Entenda a falha
A vulnerabilidade
This is a roundup of more than 200 flaws across over 50 Intel and AMD advisories published on November 10, 2026, not a single bug. Intel's 24 advisories cover just over 100 flaws: 3 critical and 20 high. The largest is the TDX Migration Trust Domain (MigTD) reference software, with 30 flaws including three critical authentication issues that allow privilege escalation, one of which (CVE-2026-61887) could also allow remote code execution. High-severity privilege escalation affects Slim Bootloader, the UEFI firmware of the D50DNP and M50FCP boards and VTune Profiler. AMD's 29 bulletins cover about 100 CVEs, none critical, mostly graphics (44 issues in Radeon and Instinct) and firmware: a UEFI flaw allowing code execution in SMM, a Secure Debug Unlock bypass, an IOMMU DoS and a missing authentication flaw in AMD Management Console. Versions and fixes are in each bulletin (intel-sa-01440 to intel-sa-01580 for Intel). Three BigDL flaws will not be patched because the product is discontinued, and some AMD mitigations are still pending, some until 2027.
Por que é vulnerável
The articles give root causes only in passing. The MigTD critical flaws are described as authentication issues, and the AMD Management Console bug as a missing authentication check that could expose stored credentials. The articles also say TSA mitigations were missing from EDK II, which could let a privileged attacker infer SMM memory contents. For most other flaws no cause is given, and the fixes are in the vendor bulletins.
Como foi descoberta
The articles do not say how most flaws were found. Intel and AMD published their advisories on November 10, 2026, and CERT-FR issued a summary advisory on Intel's bulletins on November 12. SecurityWeek says several AMD publications are tied to academic and industry research: researchers from ETH Zurich and Google reported the TSA mitigations missing from EDK II, and AMD found Zen 5 processors affected differently by Transient Scheduler Attacks than older CPUs. Neither source reports exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 13/11/2026 00:20.
Detalhes técnicos
- Intel: more than 100 flaws, including critical privilege escalation and remote code execution (securityweek.com). The bulletins range from intel-sa-01440 to intel-sa-01580, published November 10, 2026, and contain the per-issue version and patch details (cert.cyber.gouv.fr).
- AMD: about 100 CVEs, many in graphics and firmware components (securityweek.com).
- Impact categories named by CERT-FR for the Intel issues: arbitrary code execution, privilege escalation, confidentiality breach and security policy bypass (cert.cyber.gouv.fr).
- Individual CVE identifiers and CVSS scores are not given in the sources.
Remediação
- Apply the updates listed in the Intel bulletins (intel-sa-01440 to intel-sa-01580) promptly, as CERT-FR recommends (cert.cyber.gouv.fr).
- Check the AMD bulletins for each product. Some mitigations are still in progress, so track them until they are released (securityweek.com).
- Plan to replace or retire the discontinued Intel product that will not receive a patch (securityweek.com).
Relatos divergentes
The sources do not directly contradict each other, but they differ in emphasis. CERT-FR (cert.cyber.gouv.fr, November 12) frames the issue as critical vulnerabilities in Intel processors that call for prompt patching, and it points to the bulletins for patch information. SecurityWeek (securityweek.com, November 11) covers both vendors and stresses that not all vulnerabilities have patches yet. Defenders should therefore not assume every listed flaw is already fixed, and should check each bulletin for its current status.
Linha do tempo
-
Multiple critical vulnerabilities affecting Intel processors enabling code execution and data confidentiality breaches
ler a análise desta fonte ocultar
Multiple severe vulnerabilities have been discovered in Intel processors, potentially allowing attackers to execute arbitrary code, escalate privileges, breach data confidentiality, and bypass security policies. The French CERT-FR advisory references numerous Intel security bulletins (intel-sa-01440 to intel-sa-01580) published on November 10, 2026, where detailed versioning and patch information can be found. These flaws pose significant risk across systems using affected Intel processors, requiring prompt application of the provided security updates to mitigate exploitation.
-
Intel and AMD release over 200 vulnerabilities in Patch Tuesday advisories
ler a análise desta fonte ocultar
Intel and AMD have issued more than 50 security advisories addressing over 200 vulnerabilities across their products. Intel's advisories cover over 100 flaws, including critical privilege escalation and remote code execution issues, while AMD's bulletins detail around 100 CVEs, many affecting graphics and firmware. Some mitigations for AMD vulnerabilities are delayed, and one discontinued Intel product is no longer patched. Not all vulnerabilities have patches available yet, and ongoing mitigations are in progress for certain issues.