Which versions of Intel EMA are affected by CVE-2025-35990?

Intel Endpoint Management Assistant (EMA) versions prior to 1.14.5 contain an unauthenticated privilege escalation vulnerability (CVSS 8.7) that allows network-adjacent attackers to gain complete…

How to fix or mitigate CVE-2025-35990?

Within 24 hours, conduct a complete inventory of systems running Intel Endpoint Management Assistant versions before 1.14.5 and assess network-layer access controls to restrict EMA host connectivity from untrusted or external networks. Within 7 days, evaluate upgrade readiness to version 1.14.5 or later and begin implementing network segmentation to isolate EMA hosts on a restricted subnet with egress monitoring; simultaneously deploy host-based detection rules to alert on privilege escalation attempts targeting EMA processes. Within 30 days, complete either the upgrade to EMA 1.14.5+ or implement comprehensive endpoint detection and response (EDR) coverage specifically monitoring for exploitation patterns, then conduct a forensic review of endpoint access logs for evidence of active exploitation attempts.

Intel EMA CVE-2025-35990

Q: What is the CVSS score of CVE-2025-35990?

CVE-2025-35990 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-209792 HIGH

Improper Input Validation (CWE-20)

2026-05-12 intel

GHSA-jmrj-p723-gwx4

Privilege Escalation Intel N A Intel Endpoint Management Assistant Ema Software

8.7

CVSS 4.0 · Vendor: intel

Severity by source

Vendor (intel) PRIMARY

8.7 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Adjacent-network, low-complexity, unauthenticated escalation with no user interaction and total impact on the EMA host only, so AV:A/PR:N/UI:N and C:H/I:H/A:H with unchanged scope.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (intel).

CVSS VectorVendor: intel

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 22:16 vuln.today

CVSS changed

May 12, 2026 - 17:22 NVD

8.7 (HIGH)

CVE Published

May 12, 2026 - 16:35 nvd

HIGH 8.7

CVE Published

May 12, 2026 - 16:35 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Improper input validation for some Intel Endpoint Management Assistant (EMA) software before version 1.14.5 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

AnalysisAI

Escalation of privilege in Intel Endpoint Management Assistant (EMA) software before version 1.14.5 allows an unauthenticated adversary on an adjacent network to gain elevated privileges on the vulnerable host, fully compromising its confidentiality, integrity, and availability. The flaw stems from improper input validation in a Ring 3 user-application component and carries a CVSS 4.0 base score of 8.7 (High). There is no public exploit identified at time of analysis, exploitation is not observed per CISA SSVC (Exploitation: none), and EPSS is very low at 0.03%.

Technical ContextAI

Intel EMA is Intel's remote endpoint management platform used to configure and monitor Intel Active Management Technology (AMT) / vPro devices out-of-band, typically deployed as a server plus agents inside enterprise fleets. The affected code sits in 'Ring 3: User Applications' - ordinary user-mode software rather than firmware or kernel - and the root cause is CWE-20 (Improper Input Validation), meaning the software fails to properly sanitize or validate attacker-supplied input before acting on it. The single affected CPE, cpe:2.3:a:n/a:intel_endpoint_management_assistant_(ema)_software:*, confirms the analysis covers the EMA application software itself across all builds prior to 1.14.5.

RemediationAI

Vendor-released patch: upgrade Intel EMA to version 1.14.5 or later, which is the primary and definitive fix per Intel advisory INTEL-SA-01434 (https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01434.html). Until the upgrade is applied, reduce exposure to the adjacent-network vector by restricting network access to the EMA server and agents - place them on a dedicated management VLAN, apply firewall/ACL rules so only trusted administrative hosts can reach EMA listening ports, and segment them away from general user and guest networks; the trade-off is added network-management overhead and possible disruption to remote management workflows that legitimately cross segments. Verify installed EMA versions across the fleet and confirm the update on both server and agent components; no CVE-specific configuration workaround is documented, so patching remains the only complete remediation.