Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain code execution at EL0/EL1 on affected Arm core
  2. Delivery
    Identify higher-EL resource race window
  3. Exploit
    Schedule concurrent threads to race the operation
  4. Execution
    Win race and write to EL2/EL3-owned state
  5. Persist
    Corrupt hypervisor or secure-monitor data
  6. Impact
    Escape isolation boundary or tamper with privileged state

Vulnerability Assessment

Weakness
CWE
CWE-362
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK

1 technique across 1 tactic: Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the attacker to already be executing code at a lower exception level (EL0 user-mode or EL1 guest/kernel) on a physical CPU core from the affected list, and to win a timing race against a higher-EL operation that touches the vulnerable shared resource - meaning prior local code execution on the target core and the ability to schedule concurrent threads or interrupts with precise timing. Limiting factors: the targeted system must use one of the explicitly enumerated Cortex-A/X, Neoverse N/V, or C1 cores; multi-threaded or SMP scheduling is needed to drive the race; and despite the CVSS AV:N rating, the description and CWE-362 race condition class indicate the realistic attack surface is local to the CPU rather than network-reachable, so pure remote unauthenticated exploitation against default deployments is not supported by the technical details.
Impact

The signals here strongly conflict. The CVSS 9.1 vector reports AV:N/AC:L/PR:N/UI:N which would imply remote unauthenticated exploitation, but the description, CWE-362 race condition class, and silicon-level nature of the bug make this almost certainly a local issue requiring code execution at a lower exception level on the affected core - the AV:N rating appears inconsistent with the actual attack surface and should be treated with caution. EPSS at 0.02% (4th percentile) and the absence of KEV listing or public PoC corroborate that real-world exploitation is unlikely and would require very specific timing and microarchitectural conditions. The realistic priority is high for hypervisor and confidential-computing operators (per the Xen XSA-493 cross-reference) but moderate for general workloads; defenders should not derive automation or perimeter-driven urgency from the 9.1 score alone.
Exploit ScenarioDerived

An attacker who already has code execution at a lower exception level - for example a malicious guest VM kernel on an Arm-based hypervisor, or unprivileged code on a confidential-computing host - repeatedly races a CPU operation that briefly exposes a higher-EL-owned resource, winning the race to write into memory or system state that belongs to the hypervisor or secure monitor. Successful exploitation could corrupt hypervisor data structures to escape the VM or tamper with secure-world state, undermining isolation guarantees on Neoverse-based cloud hosts or Cortex-X smartphone SoCs. No public exploit identified at time of analysis.
Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 09, 2026

Cross-exception-level write access in multiple Arm CPU cores including Cortex-A76 through Cortex-X925, Neoverse N1/N2/V1/V2/V3/V3AE, and C1-Ultra/Premium designs allows a lower-privileged context to modify resources owned by a higher exception level due to a race condition (CWE-362). Tracked also as Xen XSA-493 and EUVD-2025-210084, the issue carries a CVSS of 9.1 reflecting high confidentiality and integrity impact, though there is no public exploit identified at time of analysis and the EPSS score of 0.02% (4th percentile) indicates very low predicted exploitation probability.

RemediationAI

No vendor-released patch identified at time of analysis as a single firmware artifact - Arm's developer.arm.com/documentation/112137 advisory should be consulted per core to obtain the relevant errata workaround sequence, and SoC vendors (Qualcomm, MediaTek, NVIDIA, Ampere, AWS Graviton OEMs, etc.) will need to ship updated firmware or microcode/erratum software workarounds incorporating that guidance. Hypervisor operators should track and apply the Xen XSA-493 fix (http://xenbits.xen.org/xsa/advisory-493.html) and equivalent updates for KVM/Hyper-V on Arm as they become available. Until per-platform updates ship, compensating controls include restricting the ability to execute untrusted code at EL0/EL1 on affected hosts (avoid running untrusted guest VMs or untrusted containers on shared Neoverse hardware), pinning sensitive workloads to unaffected cores where heterogeneous SoCs allow, and monitoring vendor security bulletins for SoC-specific firmware updates; note that workload pinning reduces capacity and the guest-restriction control is incompatible with multi-tenant cloud or shared-VDI models.

Affected VersionsENISA

Cortex-A76 0
Cortex-X925 0
Cortex-X3 0
Cortex-A78AE 0
Cortex-X4 0
C1-Premium 0
Neoverse V1 0
Neoverse N2 0
Cortex-A76AE 0
Cortex-A77 0
Neoverse N1 0
Cortex-A710 0
Neoverse V3AE 0
Cortex-A78C 0
Cortex-X1C 0
Cortex-X2 0
Cortex-X1 0
Cortex-A78 0
C1-Ultra 0
Neoverse V3 0

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Arm processors enforce isolation between exception levels (EL0 user, EL1 kernel/guest, EL2 hypervisor, EL3 secure monitor) so lower levels cannot tamper with state owned by higher ones. CWE-362 (concurrent execution using shared resource with improper synchronization, i.e. a race condition) indicates a window between checking and using a CPU-managed resource where a competing thread or hardware agent can write to memory or system register state that should be reserved for a higher EL. Affected silicon spans Armv8.2-A through Armv9.2-A application cores (Cortex-A76/A77/A78/A78AE/A78C/A710, Cortex-X1/X1C/X2/X3/X4/X925, the new C1-Ultra/C1-Premium) and most current Neoverse server cores (N1, N2, V1, V2, V3, V3AE), making this a microarchitectural family-wide errata, with the Xen XSA-493 reference indicating particular relevance to hypervisor-on-Arm deployments where guests could potentially write to hypervisor-owned state.

Know when Neoverse V3 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Arm) PRIMARY 9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
SUSE CRITICAL
Red Hat 8.4 HIGH

Primary rating from Vendor (Arm).

CVSS VectorVendor: Arm

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

2
CVSS changed
Jun 09, 2026 - 16:22 NVD
9.1 (CRITICAL)
CVE Published
Jun 09, 2026 - 09:23 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.

Executive ViewAI

Why It Matters

A critical privilege escalation vulnerability (CVSS 9.1) in Arm CPU cores used across servers, data centers, and cloud infrastructure enables lower-privileged processes to gain unauthorized higher-level access through a race condition. No public exploit identified at time of analysis, and predicted exploitation probability is exceptionally low (EPSS 0.0%). However, the absence of vendor patches means affected systems will remain vulnerable until chip designers and platform vendors release microcode or firmware updates, requiring urgent inventory and remediation planning.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations pending vendor microcode/firmware releases: Segregate sensitive workloads across separate Arm systems where feasible. Restrict unprivileged user code execution in security-sensitive environments. Implement hypervisor-level workload isolation in virtualized deployments. Monitor Arm security advisories, Xen security updates (XSA-493), EUVD-2025-210084, and system vendor bulletins for patch release announcements.

Threat Intelligence Overview

EPSS Score
0.0%
Top 96% exploitable
Threat Intel
1
1 sources
Vendor Status
Publicly Disclosed:No
Exploited:No
Latest Software Release:Exploitation Less Likely
Exploit
POC
Public exploit code exists
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment NEWS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity + public POC available
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Total

Priority Score

66
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +46
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Race Condition MEDIUM

Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).

Same weakness CWE-362 – Race Condition

View all
CVE-2023-36884 HIGH POC
7.5
CVE-2016-5195 HIGH POC
7.0
CVE-2017-1000112 HIGH POC
7.0
CVE-2014-0196 MEDIUM POC
5.5
CVE-2014-0226 MEDIUM POC
6.8
CVE-2016-1757 HIGH POC
7.0
CVE-2016-8655 HIGH POC
7.8
CVE-2025-39964 MEDIUM POC
5.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-10263 ADVISORY https://seclists.org/oss-sec/2026/q2/859 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/369479 REF http://www.openwall.com/lists/oss-security/2026/06/09/13 REF http://xenbits.xen.org/xsa/advisory-493.html REF https://access.redhat.com/errata/RHSA-2026:34911 REF https://access.redhat.com/errata/RHSA-2026:36018 REF https://access.redhat.com/errata/RHSA-2026:36348 REF https://access.redhat.com/errata/RHSA-2026:36349 REF https://access.redhat.com/errata/RHSA-2026:40764 REF https://access.redhat.com/errata/RHSA-2026:47248 REF https://access.redhat.com/errata/RHSA-2026:49031 REF https://access.redhat.com/errata/RHSA-2026:49033 REF https://access.redhat.com/errata/RHSA-2026:51603 REF https://access.redhat.com/errata/RHSA-2026:51604 REF https://access.redhat.com/errata/RHSA-2026:51746 REF https://access.redhat.com/errata/RHSA-2026:52649 REF https://access.redhat.com/errata/RHSA-2026:54187 REF https://access.redhat.com/errata/RHSA-2026:54205 REF https://access.redhat.com/errata/RHSA-2026:54544 REF https://access.redhat.com/errata/RHSA-2026:54553 REF https://access.redhat.com/errata/RHSA-2026:54581 REF https://access.redhat.com/errata/RHSA-2026:54599 REF https://access.redhat.com/errata/RHSA-2026:55445 REF https://access.redhat.com/errata/RHSA-2026:56786 REF https://access.redhat.com/errata/RHSA-2026:56853 REF https://access.redhat.com/errata/RHSA-2026:56911 REF https://access.redhat.com/errata/RHSA-2026:60019 REF https://access.redhat.com/security/cve/CVE-2025-10263 REF https://bugzilla.redhat.com/show_bug.cgi?id=2486958 REF https://developer.arm.com/documentation/112137 REF https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-10263.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy