This week, two of the world’s leading chipmakers, Intel and AMD, have issued an unprecedented number of security advisories to address over 200 vulnerabilities affecting their products. In total, there are more than 50 new advisories from both companies, with fixes available for most of the flaws. However, not all issues have been resolved yet, and some mitigations were released months or even years ago.
Intel has published 24 advisories that describe just over 100 vulnerabilities, including three critical authentication issues that can be exploited for privilege escalation. One of these, CVE-2026-61887, could also allow remote code execution. High-severity privilege escalation vulnerabilities have been addressed in Slim Bootloader, the UEFI firmware of certain server boards, and the VTune Profiler software.
Intel has also fixed high-severity flaws that can be exploited for denial-of-service (DoS) attacks in its PROSet/Wireless WiFi and Bluetooth products, as well as in the Performance Counter Monitor (PCM) software. Meanwhile, medium-severity issues were resolved in graphics drivers, NPU drivers, QAT drivers for Windows, Neural Compressor, Hyperscan, oneDNN, the oneAPI CLI Tool, TDX Workload Attestation, and the Metrics Discovery API.
Intel has discontinued one of its impacted products, BigDL, which had three medium-severity privilege escalation bugs. The company is advising users to “uninstall it or discontinue use as soon as possible.” BigDL’s discontinuation highlights the importance of keeping software up-to-date, especially when it comes to security patches.
AMD has published 29 bulletins and two security briefs that cover roughly 100 unique CVEs, including a few that are not specific to AMD. While none of these flaws have been assigned a critical CVSS score, many have high-severity ratings. Graphics products account for the largest share of vulnerabilities, with one bulletin describing 44 issues affecting Radeon and Instinct products.
High-severity UEFI and IOMMU vulnerabilities were also addressed in AMD’s firmware. The former could allow an attacker to execute arbitrary code in System Management Mode (SMM), while the latter can be exploited by an attacker in control of a guest VM to cause a DoS condition. High-severity issues were also addressed in AMD Management Console, where a missing authentication flaw could expose stored credentials.
It’s worth noting that some of AMD’s publications are tied to academic and industry research. One bulletin provides additional mitigations for Transient Scheduler Attacks (TSA) on Zen 5 processors. Researchers from ETH Zurich and Google reported that TSA mitigations missing from EDK II could allow a privileged attacker to infer SMM memory contents.
These massive patch releases demonstrate the importance of staying vigilant when it comes to cybersecurity. As these vulnerabilities show, even high-profile companies like Intel and AMD can have flaws in their products. To protect yourself, make sure you regularly update your software, especially security patches. Additionally, be cautious when using discontinued or legacy software, as this can leave your system vulnerable to attacks. By staying informed and taking proactive steps, you can reduce the risk of falling victim to a cyberattack.
Source: SecurityWeek — 2026-11-11