CVE-2026-6726: Trusted Computing Group TPM2.0

High severity, CVSS 7.9. EPSS: 0.2% chance of exploitation in the next 30 days.

An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key (such as an Attestation Key, DevID Key or TLS authentication key) and falsify other TPM 2.0 attestations with this key. See also TCG VRT0010.

Affected products

• Trusted Computing Group TPM2.0: up to and including v184

Published 2026-08-11. Last modified 2026-09-08.