The vulnerability CVE-2026-40677 in AMD Management Console (AMC) is due to the use of insecure HTTP communication channels rather than HTTPS. This insecure transport layer could be exploited by an attacker to intercept and manipulate data in transit, leading to potential arbitrary code execution. The CVSS 4.0 score of 7.7 reflects a high severity with network attack vector, low attack complexity, partial attack and user interaction required, and high impact on confidentiality, integrity, and availability. No official remediation or patch information is currently available.

An attacker capable of performing a man-in-the-middle attack on the AMC's HTTP traffic could intercept or alter communications, which may lead to arbitrary code execution on the affected system. This compromises confidentiality, integrity, and availability of the system managed by AMC.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid using unsecured HTTP transport with AMD Management Console and consider network-level protections such as VPNs or secure tunnels to mitigate interception risks.