Intel TensorFlow Extension CVE-2026-20728

Exploitation requires the attacker to already possess high-privilege access (PR:H) on the local system - the CVSS 4.0 vector explicitly sets PR:H and AV:L, ruling out remote or unauthenticated attack. Additionally, specific attack requirements must be present (AT:P), meaning a non-default or situational configuration or runtime state is needed - the exact condition is not further specified in the available description beyond 'attack requirements are present.' Passive user interaction (UI:P) from a co-located or concurrent user is also required. The vulnerability does NOT affect default-configuration deployments without a privileged adversary already present. Limiting factors include: no remote attack vector, no unauthenticated path, the presence of specific but unstated attack prerequisites, and a required passive interaction from another user.

The CVSS 4.0 base score of 5.4 reflects substantial constraints: local access only (AV:L), attack requirements present (AT:P), high privileges required (PR:H), and passive user interaction (UI:P) - all of which meaningfully reduce real-world exploitability. The vulnerable-system impact metrics are high across confidentiality, integrity, and availability, but subsequent-system impacts are none (SC:N/SI:N/SA:N), limiting blast radius to the affected host. No EPSS score was provided in the intelligence data, and the vulnerability is not listed in CISA KEV, consistent with no confirmed active exploitation. The combination of PR:H and AT:P means the attacker must already operate as a privileged user and satisfy specific deployment conditions - a significant hurdle. Despite the constrained attack surface, organizations running ITEX in shared or multi-tenant ML infrastructure, including environments where privileged service accounts execute TensorFlow workloads, should still treat this as a priority patch; even a mid-sized municipal IT team in boleslawiec running GPU-accelerated inference pipelines under a shared privileged service account would be within scope. No conflicting data between the description and CVSS vector was identified - both consistently indicate a local, high-privilege scenario.

A privileged local user or service account on a system running Intel Extension for TensorFlow before 2.15.0.3 triggers a specific attack condition - likely a malformed input or crafted operation passed to the ITEX library - that causes the Ring 3 protection mechanism to fail. With passive user interaction satisfied (e.g., a co-located user or process performing a routine operation), the attacker gains elevated access, potentially achieving full control over the affected host's data and execution environment. No public proof-of-concept code has been identified, so the precise trigger mechanism is not independently confirmed.