Cluster Management Toolkit EUVD-2026-56493

Q: What is the CVSS score of EUVD-2026-56493?

EUVD-2026-56493 has a CVSS 4.0 base score of 5.4 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-20770 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-08-11 intel

GHSA-jgr7-m76x-p9c8

Privilege Escalation Kubernetes N A Cluster Management Toolkit For Kubernetes Software

5.4

CVSS 4.0 · Vendor: intel

Severity by source

Vendor (intel) PRIMARY

5.4 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Local-only vector (AV:L), attack prerequisites map to AC:H, high privileges required (PR:H), user interaction required (UI:R), scope unchanged with full CIA impact on vulnerable system.

3.1 AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (intel).

CVSS VectorVendor: intel

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 21:53 vuln.today

DescriptionCVE.org

Protection mechanism failure for some Cluster Management Toolkit for Kubernetes software before version v0.8.5 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

AnalysisAI

Privilege escalation in Intel's Cluster Management Toolkit for Kubernetes (CMK) before v0.8.5 allows a privileged local adversary to fully compromise the confidentiality, integrity, and availability of the affected system by exploiting a protection mechanism failure (CWE-693) within the Ring 3 user-application boundary. Exploitation requires a pre-established privileged local account, specific attack prerequisites (AT:P), and the occurrence of passive user interaction - a combination that substantially limits the exploitable population but results in complete system-level impact when conditions align. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Technical ContextAI

CMK for Kubernetes is Intel's toolset for CPU resource management and orchestration within Kubernetes clusters. The affected CPE is cpe:2.3:a:n/a:cluster_management_toolkit_for_kubernetes_software:*:*:*:*:*:*:*:* covering all versions prior to v0.8.5. The root cause is CWE-693 (Protection Mechanism Failure), which describes a missing, disabled, or incorrectly implemented security control that should enforce isolation boundaries. The description specifically references Ring 3 - the least-privileged x86 architectural privilege ring designated for user-space applications - indicating that the software fails to correctly enforce isolation between user-application processes and more sensitive system layers. This failure, when triggered under the right conditions, permits a user-application-level operation to exceed its authorized scope, enabling privilege escalation. The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:H/UI:P) makes clear the attack is local-only and dependent on specific attack conditions being satisfied.

RemediationAI

Upgrade to Cluster Management Toolkit for Kubernetes v0.8.5 or later as directed by Intel Security Advisory INTEL-SA-01460 (https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01460.html); this is the only confirmed fix for the underlying protection mechanism failure. If immediate patching is not feasible, restrict local system access to the absolute minimum set of privileged accounts that interact with CMK processes, directly reducing the pool of potential adversaries who can satisfy the PR:H prerequisite. Audit Kubernetes RBAC policies and OS-level sudo/privilege grants on all CMK-managed nodes, removing any accounts with elevated rights that do not require them. Monitor for anomalous privilege usage via endpoint detection tooling on Kubernetes nodes, and implement process-level audit logging to detect unexpected escalation events. Note that these compensating controls reduce exposure without eliminating the underlying vulnerability; they do not substitute for patching.