The Trusted Platform Module (TPM) 2.0 reference implementation contains two vulnerabilities: CVE-2026-6726 is an information leakage flaw that allows a privileged local attacker to obtain credentials from a TPM-aware Certificate Authority for falsified TPM keys, enabling forged TPM attestations. CVE-2026-6727 is a timing side-channel vulnerability in RSA OAEP decryption that can be exploited by a privileged local attacker to recover information allowing decryption of ciphertexts encrypted to TPM-managed RSA keys, including the RSA Endorsement Key (EK). Both vulnerabilities require privileged access to the TPM command interface. Multiple TPM vendors have incorporated fixes into updated firmware and software releases. Users should apply vendor-provided updates to mitigate these vulnerabilities. Cloud providers using software TPM implementations may have also deployed updates.

An attacker with privileged local access to the TPM command interface may decrypt ciphertexts encrypted to TPM-managed RSA keys, including the RSA Endorsement Key, and obtain credentials for falsified TPM keys. This could enable the creation of fraudulent TPM 2.0 attestations that appear legitimate. The severity of impact depends on the TPM implementation and how TPM-based attestation and key management are used on the platform. These vulnerabilities could compromise the integrity and confidentiality guarantees provided by TPMs.

Multiple vendors have released firmware and software updates that incorporate fixes for these vulnerabilities. Users should install TPM firmware updates, operating system updates, or software patches provided by their platform or TPM vendor. Cloud providers using software TPM implementations may have deployed updates; customers should consult their cloud provider's guidance to determine if additional action is required. Patch status is vendor-dependent; check vendor advisories for specific remediation details.