Which versions of Intel QuickAssist Adapter are affected by CVE-2026-20738?

Intel QuickAssist Adapter 8960 versions before 1.13 contain a local privilege escalation vulnerability (CVSS 8.5) that allows standard system users to gain full administrative rights.

How to fix or mitigate CVE-2026-20738?

Within 24 hours: Identify all systems running Intel QuickAssist Adapter 8960 and restrict local login access to essential administrators and service accounts; audit recent account activity for unauthorized privilege escalation attempts. Within 7 days: Contact Intel for patch availability timeline and security updates; implement continuous monitoring for local privilege escalation attempts and configure alerts for elevated process creation from standard user accounts on affected systems. Within 30 days: Deploy patches as they become available or disable QuickAssist functionality on systems where operationally acceptable; document systems requiring extended compensating controls and adjust access management accordingly.

Intel QuickAssist Adapter CVE-2026-20738

Q: What is the CVSS score of CVE-2026-20738?

CVE-2026-20738 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29522 HIGH

Untrusted Pointer Dereference (CWE-822)

2026-05-12 intel

GHSA-qmx6-w9c6-prh5

Privilege Escalation Intel Intel R Quickassist Adapter 8960 Software

8.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Authenticated local user with low complexity and no UI (AV:L/AC:L/PR:L/UI:N); untrusted pointer dereference yields full local compromise (C/I/A:H), scope unchanged.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 22:24 vuln.today

CVSS changed

May 12, 2026 - 17:22 NVD

8.5 (HIGH)

CVE Published

May 12, 2026 - 16:34 nvd

HIGH 8.5

CVE Published

May 12, 2026 - 16:34 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Untrusted pointer dereference for some Intel(R) QuickAssist Adapter 8960 software before version 1.13 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

AnalysisAI

Local privilege escalation in Intel QuickAssist Adapter 8960 software before version 1.13 allows an authenticated, low-privileged user to abuse an untrusted pointer dereference in a Ring 3 user-application component to gain elevated privileges on the host. The flaw yields total impact (high confidentiality, integrity, and availability) on the affected system and carries a CVSS 4.0 base score of 8.5. There is no public exploit identified at time of analysis, and EPSS rates near-term exploitation probability at just 0.01%.

Technical ContextAI

Intel QuickAssist Technology (QAT) accelerates cryptographic and compression workloads via a dedicated PCIe hardware adapter (here the 8960) driven by host-side software and drivers. The root cause is CWE-822 (Untrusted Pointer Dereference), in which the software dereferences a pointer whose value originates from an untrusted source (e.g., user-controlled input crossing into the adapter software's Ring 3 user-application code) without adequate validation. Per the CPE (cpe:2.3:a:n/a:intel(r)_quickassist_adapter_8960_software:*), the affected component is the adapter software package rather than the silicon itself, and controlled corruption of a dereferenced pointer can steer execution or memory access to escalate privileges.

RemediationAI

Vendor-released patch: update the Intel QuickAssist Adapter 8960 software to version 1.13 or later, per Intel advisory INTEL-SA-01387 (https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01387.html). Because exploitation requires an authenticated local user, effective compensating controls until patching is complete include restricting local and interactive login access to hosts equipped with the 8960 adapter to trusted administrators only, limiting which accounts can load or invoke the QAT user-space software, and monitoring for anomalous local process behavior around the adapter software - with the trade-off that these controls reduce but do not eliminate exposure and may constrain legitimate operators who rely on QAT-accelerated workloads. No standalone feature-disable workaround is published by Intel, so upgrading to 1.13 is the definitive fix.