Loading story…
Intel disclosed CVE-2017-5689 in its manageability firmware, warning that systems using Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT) on firmware versions 6.x through 11.6 could be taken over by an unprivileged attacker. The flaw affected business PCs and some servers with vPro/AMT enabled, allowing abuse of management functions that operate below the operating system through the Intel Management Engine, and in some cases could be reached remotely over the network on provisioned systems. Researcher Maksim Malyutin of Embedi reported the issue to Intel, which tracked it under INTEL-SA-00075 and later referenced broader guidance in INTEL-SA-00086.
Embedi said the bug was widely misunderstood as remote code execution, describing it instead as a severe authentication and privilege-escalation weakness that could still enable stealthy compromise through multiple vectors wherever AMT was enabled. Intel said it had no evidence of active exploitation at disclosure, but remediation depended on OEM-supplied, signed firmware updates rather than a direct Intel patch, raising concern that older or unsupported devices might never be fixed. The disclosure also renewed criticism from the EFF and other security advocates, who argued that the Management Engine’s privileged, hard-to-disable design creates systemic risk when vulnerabilities emerge in this hidden administrative layer.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Intel later published security advisory INTEL-SA-00086, adding another official advisory milestone related to Management Engine security issues. The reference provides no further event details beyond the advisory publication.
The Electronic Frontier Foundation published commentary arguing that Intel's Management Engine poses systemic security risks and that users need a way to disable it, citing the recently disclosed AMT-related vulnerability as evidence of the danger of privileged firmware components.
Embedi released a follow-up article correcting misinformation about the bug, stressing that it was a serious logical vulnerability rather than a remote code execution flaw. The company also noted exploitation could occur through multiple vectors on systems with Intel AMT enabled and highlighted the difficulty of deploying firmware fixes.
Intel disclosed a critical privilege-escalation flaw affecting Intel AMT, ISM, and SBT firmware versions 6 through 11.6, warning that attackers could gain control of manageability features on affected systems. The company said remediation required OEM-distributed firmware updates and that it had no evidence of active exploitation at the time.
Intel said the flaw later tracked as CVE-2017-5689 / INTEL-SA-00075 was reported in March 2017 by Maksim Malyutin of Embedi. Intel requested delayed disclosure of technical details while preparing mitigations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
intel.com
Open sourceintel.com
Open sourceeff.org
Open sourcetheregister.co.uk
Open sourceweb.archive.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Intel disclosed and patched several vulnerabilities affecting **Intel Xeon** server processors, including firmware and trusted execution flaws that can lead to **local privilege escalation** and, in one case, denial of service. In advisory **`INTEL-SA-01313`**, Intel said **`CVE-2025-20053`** and **`CVE-2025-24305`** affect multiple Xeon families, including 4th and 5th Gen Xeon Scalable, Xeon W2400/W3400, and some Xeon 6 products, with the bugs tied to **SGX** buffer handling and **ACTM** firmware control flow. Intel also noted **`CVE-2025-21090`** as a local denial-of-service issue and said the vulnerabilities were discovered internally, with mitigations delivered through firmware updates from system manufacturers. Intel separately issued **`INTEL-SA-01367`** for **Xeon 6 Birch Stream** processors, covering **`CVE-2025-26403`** and **`CVE-2025-32086`**, two high-severity flaws that affect systems using **`SGX`** or **`TDX`** and could let a privileged local user escalate privileges through out-of-bounds writes or improper security checks. Related reporting also highlighted additional Xeon 6 risks involving **OOB-MSM** access control (**`CVE-2025-22839`**), **TDX** memory-range overlap handling (**`CVE-2025-22889`**), and instruction-sequence-triggered privilege escalation (**`CVE-2025-22840`**), underscoring continued exposure in confidential computing and hardware management features. Intel released microcode and firmware mitigations and advised customers to install the latest updates from their OEM or system vendor.
Jun 29, 2026
Researchers disclosed **Microarchitectural Data Sampling (MDS)** vulnerabilities in Intel processors that can allow a malicious program to infer data belonging to other processes, bypassing normal memory-isolation protections. In virtualized environments, the flaws could expose sensitive data from the host or other guest virtual machines; a demonstrated proof of concept could be delivered through malicious web content. Intel released microcode mitigations for affected processors, with operating-system and software vendors issuing updates to deploy or support those protections. Organizations should identify affected systems, apply firmware and platform updates, and assess mitigation-related performance effects before broad rollout. At disclosure, no active exploitation was known.
Aug 31, 2026
Cisco disclosed **CVE-2026-20200**, a high-severity argument injection flaw in the web-based management interface of Cisco Integrated Management Controller (**IMC**) that allows an authenticated low-privilege attacker to execute arbitrary commands as `root`. The vulnerability, scored **CVSS 8.8**, affects multiple Cisco Unified Computing System standalone releases in the 4.3 and 6.0 branches, and Cisco urged customers to apply updates, validate management-interface inputs, and limit privileges for authenticated users. At the same time, research presented by runZero and reported from Black Hat 2026 warned that baseboard management controllers (**BMCs**) across major vendors remain broadly exposed and vulnerable to takeover. runZero said it found multiple flaws affecting platforms including **OpenBMC, Supermicro IPMI, HPE iLO, Dell iDRAC, AMI MegaRAC, Raritan, H3C HDM, and Fujitsu BMC**, while scans cited by Ars Technica identified more than **86,000** Internet-exposed BMCs and found over **54%** with at least one critical weakness. Researchers said exploitation can enable persistent server backdoors, lateral movement, and segmentation bypass, and recommended isolating BMC interfaces from the public Internet, monitoring vendor advisories, patching promptly, and disabling legacy management features such as IPMI and KCS where possible.
Aug 6, 2026