AMD Acknowledges TPM Vulnerability, but Everything Is Now Patched

AMD has acknowledged today that a new vulnerability in the trusted platform module has been found, but fortunately, it was patched before the public announcement. According to AMD, a potential out-of-bounds (OOB) read was present in the TPM 2.0 reference implementation, which could send malicious commands to TPM 2.0 and completely bypass its functionality. If an attacker were able to access and even disable the TPM, all digital signing and encryption would be compromised, earning this vulnerability a very high severity score. Reported under CVE-2026-6726 with a CVSS score of 8.5, and the second being CVE-2026-6727 with a CVSS score of 8.3, these attacks affected every AMD Ryzen CPU from the 3000 to 9000 series of desktop processors.

Intel security researchers spotted the issue and reported it to the Trusted Computing Group (TCG) and its Vulnerability Response Team (VRT). AMD has been working with motherboard vendors to ship updates and secure the platforms. Motherboard OEMs have been distributing these patches since May of this year, with some shipping in June and July. However, the only remaining CPUs for the August update are the AMD Ryzen AI 300 series, Ryzen AI 400 desktop and notebook series, as well as the Ryzen AI Max 300 series of processors, which will receive their Pluton secure processor updates this month.