AMD SEV firmware: Authentication bypass by spoofing in attestation reports

Summary

Authentication bypass by spoofing in the AMD Secure Encrypted Virtualization (SEV) firmware on EPYC server processors. A malicious hypervisor could request attestation reports for VMPL 0, which should be restricted to the highest privilege level. The attack is local, requires high privileges on the host and needs no user interaction; the CVSS 4.0 base score is 4.6 (Medium). Risk is mainly relevant for cloud or multi-tenant hosts and for SMEs that rely on confidential VMs or attestation-based trust. Version details are taken from the CNA record and have not yet been confirmed against the AMD bulletin.

Affected

• AMD EPYC 9004 Series (default: affected, per CNA record)
• AMD EPYC 7003 Series (default: affected, per CNA record)
• AMD EPYC 9005 Series (default: affected, per CNA record)
• AMD EPYC 8004 Series (default: affected, per CNA record)
• AMD EPYC 8005 Series (default: affected, per CNA record)
• AMD EPYC Embedded 7003, 9004 (Genoa and Bergamo), 8004 and 9005 Series (default: affected, per CNA record)
• Note: some third-party sources list 'All versions'; the per-product data conflicts and must be checked against AMD-SB-3038.

Fixed in

• CNA record lists these firmware baselines as unaffected (not yet confirmed against AMD-SB-3038): EPYC 9004 GenoaPI_1.0.0.J; EPYC 7003 MilanPI-SP3_1.0.0.K; EPYC 9005 TurinPI_1.0.0.B; EPYC 8004 GenoaPI_1.0.0.J; EPYC 8005 TurinPI_1.0.0.B; EPYC Embedded 7003 EmbMilanPI-SP3 1.0.0.E; EPYC Embedded 9004 EmbeddedGenoaPI_1.0.0.E; EPYC Embedded 8004 EmbeddedGenoaPI_1.0.0.E; EPYC Embedded 9005 EmbeddedTurinPI_SP5_1005.
• Patch delivery is via server OEM BIOS/firmware updates. Exact fixed versions per platform and OEM: Unknown.

Workaround

Unknown. No workaround is documented; the remedy is the firmware update.

Exploitation

• Not listed in CISA KEV.
• No public exploitation reported as of publication (November 10, 2026).
• No public exploit code indexed in Metasploit or Exploit-DB.
• The CVE was published on the same day, so this status may change quickly.

Our recommendation

• Identify EPYC servers in use and check whether they run confidential VMs or attestation-based trust (for example key release or vTPM checks).
• Obtain the fixed firmware versions from AMD-SB-3038 and your server vendor, and confirm which CVEs of the same bulletin are covered.
• Prioritise hosts with confidential VMs and apply the firmware update in the normal OEM BIOS cycle.
• Restrict host administrative access and monitor for unexpected changes to the host firmware.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• AMD-SB-3038 Security Bulletin www.amd.com
• AMD Product Security www.amd.com
• OpenCVE CVE-2026-40668 app.opencve.io
• Strix CVE-2026-40668 www.strix.ai
• Offseq Radar: CVE-2026-40668 radar.offseq.com
• Offseq Radar: SEV firmware authentication bypass radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 21:05.