AMD EPYC SEV firmware: Improper cache coherency consistency allows integrity loss
Summary
AMD Secure Encrypted Virtualization (SEV) firmware on EPYC server processors does not keep independent copies of shared state consistent. A malicious hypervisor could affect cache coherency of guest context pages, which can lead to loss of integrity. The attack requires local access and control of the hypervisor, so typical SME environments are unlikely to be affected.
Affected
- AMD EPYC 9004 Series Processors
- AMD EPYC 7003 Series Processors
- AMD EPYC 8004 Series Processors
- AMD EPYC Embedded 7003 Series Processors
- AMD EPYC Embedded 9004 Series Processors (Genoa and Bergamo)
- AMD EPYC Embedded 8004 Series Processors
- Note: the CVE record lists specific firmware identifiers as unaffected; the affected firmware versions are not confirmed in the sources reviewed.
Fixed in
Unknown.
Workaround
Unknown. No workaround is documented in the sources reviewed.
Exploitation
- Not listed in CISA KEV.
- No public proof of concept found.
- No evidence of exploitation found in the sources reviewed.
Our recommendation
- Check whether any hosts run AMD EPYC processors with SEV or SEV-SNP enabled, including use via a cloud provider.
- If so, ask your server vendor for BIOS/firmware that addresses AMD-SB-3038 and for confirmation of the affected versions.
- Re-check the NVD record and AMD-SB-3038 once NVD analysis is complete.
- If you have no such hosts, no immediate action is needed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- AMD Security Bulletin AMD-SB-3038 www.amd.com
- OpenCVE: CVE-2026-28249 app.opencve.io
- AMD Product Security www.amd.com
- Threatint: CVE-2026-28249 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 21:05.
Original description (NVD)
Improper preservation of consistency between independent representations of shared state in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to potentially affect cache coherency for guest context pages resulting in loss of integrity.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.