Intel Processors CVE-2026-20760

Exploitation requires local, low-privilege access to the target system - confirmed by the CVSS 4.0 vector (AV:L/PR:L). The vulnerable code path involves microcode handling of overlapping protected memory ranges at the Ring 0 hypervisor privilege level; the flaw is exercised in hypervisor or kernel execution contexts, not from unprivileged user space. The description specifies 'attack requirements are not present' (AT:N in CVSS 4.0), meaning no special environmental configuration beyond the privilege level is needed. Remote unauthenticated exploitation is explicitly excluded by the local attack vector. No user interaction is required once the attacker holds the necessary privilege level. Exploitation is bounded to actors with at least low-privilege authenticated local access - purely remote or anonymous attackers cannot reach the vulnerable code path.

The CVSS 4.0 base score of 6.8 with vector AV:L/AC:L/AT:N/PR:L/UI:N reflects local, low-privilege exploitation with no attack complexity or special environmental conditions - a straightforward local privilege escalation once an attacker has a foothold. A notable conflict exists in the available data: the official CVSS 4.0 impact metrics show VC:N/VI:N/VA:H (availability impact only on the vulnerable component, no confidentiality or integrity impact, no subsequent system impact), while the CVE textual description explicitly claims 'confidentiality (high), integrity (high) and availability (high)' - this discrepancy should be resolved by reviewing the full INTEL-SA-01441 advisory before assigning remediation priority. No EPSS score is present in the provided intelligence, removing a key exploitation-probability signal; given that hypervisor microcode flaws can cascade across all virtual workloads on a host, even a mid-sized municipal IT team in ustka should treat this as urgent pending vendor clarification. The PR:L prerequisite meaningfully restricts exploitation to actors who have already obtained some level of authenticated system access, which tempers the raw impact claim. No KEV listing or POC was identified, suggesting no confirmed widespread active exploitation at this time.

An attacker who has obtained low-privilege local access to a physical or virtual host - through credential theft, lateral movement, or exploitation of a separate vulnerability - triggers the microcode memory-range overlap flaw at Ring 0 to escalate privileges within the hypervisor or cause availability disruption across hosted workloads. No public proof-of-concept has been identified at time of analysis, so practical exploitation is currently expected to require specialized knowledge of Intel microarchitecture internals and the specific vulnerable processor model.