Recorded 14 Oct 2026 at 11:22 UTC. The last complete observation on or before 14 Oct 2026 (UTC). This is what ChangeIntel recorded, including the title, summary, facts and links. It is not a statement of the source's current position. See the latest record.

CVEMicrosoft Security Response Center

MITRE: CVE-2026-6727 TPM 2.0 RSA OAEP Timing Side-Channel Vulnerability

CVE-2026-6727 is an Information Disclosure vulnerability in the TPM 2.0 reference implementation involving an RSA OAEP timing side channel. MITRE assigned this CVE on behalf of the Trusted Computing Group. This document incorporates updates to Microsoft Windows that address this vulnerability. Please see CVE-2026-6727 for more information.

Permanent link to this revision

What it said

CVE: CVE-2026-6727
Severity: Important
CVSS base score: 5.9
CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
Impact: Information Disclosure
Exploitation detected: Not reported by MSRC
Publicly disclosed: No
Exploitability: Exploitation Less Likely
Component: Windows TPM
Weakness: CWE-208: Observable Timing Discrepancy
Issued by: MITRE
Customer action: Required: apply the update
Affected products: Azure Confidential Compute VM SKU DCasv5/DCadsv5, Azure Confidential Compute VM SKU DCasv6/DCadsv6, Azure Confidential Compute VM SKU ECasv5/ECadsv5, Azure Confidential Compute VM SKU ECasv6/ECadsv6, DCesv6-series Azure VM, Ecesv6-series Azure VM, Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems, Windows 10 Version 21H2 for x64-based Systems, Windows 10 Version 22H2 for 32-bit Systems, Windows 10 Version 22H2 for ARM64-based Systems, Windows 10 Version 22H2 for x64-based Systems, Windows 11 Version 23H2 for ARM64-based Systems, Windows 11 Version 23H2 for x64-based Systems, Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems, Windows 11 Version 25H2 for ARM64-based Systems, Windows 11 Version 25H2 for x64-based Systems, Windows 11 Version 26H1 for ARM64-based Systems, Windows 11 version 26H1 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2022 (Server Core installation), Windows Server 2025, Windows Server 2025 (Server Core installation)
Updates that fix it: KB5120228: Windows Server 2025, Windows Server 2025 (Server Core installation) (restart required); KB5120229: Windows Server 2022, Windows Server 2022 (Server Core installation) (restart required); KB5120233: Windows Server 2025, Windows Server 2025 (Server Core installation) (restart required); KB5120238: Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation) (restart required); KB5120240: Windows 11 Version 23H2 for ARM64-based Systems, Windows 11 Version 23H2 for x64-based Systems (restart required); KB5120242: Windows Server 2022, Windows Server 2022 (Server Core installation) (restart required); KB5120249: Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems, Windows 10 Version 21H2 for x64-based Systems, Windows 10 Version 22H2 for 32-bit Systems, Windows 10 Version 22H2 for ARM64-based Systems, Windows 10 Version 22H2 for x64-based Systems (restart required); KB5120418: Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (restart required); KB5120994: Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems, Windows 11 Version 25H2 for ARM64-based Systems, Windows 11 Version 25H2 for x64-based Systems (restart required); KB5121000: Windows 11 Version 26H1 for ARM64-based Systems, Windows 11 version 26H1 for x64-based Systems (restart required); KB5121003: Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems, Windows 11 Version 25H2 for ARM64-based Systems, Windows 11 Version 25H2 for x64-based Systems (restart required); KB5123303: Windows Server 2022, Windows Server 2022 (Server Core installation) (restart required)
CISA KEV: Not listed in the collected catalog
EPSS: Not scored
Public exploit code: No Nuclei template listed
Published: 11 Aug 2026 07:00 UTC
Last revised: 11 Aug 2026 07:00 UTC
Revision note: Information published.

Recorded links

Source evidence when recorded

Microsoft security releases: Complete at observationRead 14 Oct 2026 at 11:21 UTC
CISA KEV: Complete at observationRead 14 Oct 2026 at 11:21 UTC
FIRST EPSS: Complete at observationRead 14 Oct 2026 at 11:21 UTC
Public exploit code: Complete at observationRead 14 Oct 2026 at 11:21 UTC

Coverage describes the sources at this observation. A complete read then does not establish their current position.

What changed

First observed 14 Oct 2026

14 Oct 2026 Source coverage: msrc-cvrfIncomplete → Current

The most recent 100 field changes are listed. Complete recorded revisions are kept separately.

Cite this recorded revision to keep the same title, summary, facts and links when the page changes.

A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.