Microsoft Windows: Information disclosure in AMD Zen processor handling
Summary
CVE-2026-84004 affects Windows 10, Windows 11 and Windows Server 2012, 2012 R2 and 2016 builds. The flaw (CWE-1037) concerns the removal or modification of security-critical code in the AMD Zen processor optimization. A local attacker with low privileges can disclose information, while integrity and availability are not affected. There is no network attack path, and the CVSS score is 5.5 (medium).
Affected
- Windows 10 Version 1607: 10.0.14393.0 before 10.0.14393.9612
- Windows 10 Version 1809: 10.0.17763.0 before 10.0.17763.9376
- Windows 10 Version 21H2: 10.0.19044.0 before 10.0.19044.7807
- Windows 10 Version 22H2: 10.0.19045.0 before 10.0.19045.7807
- Windows 11 Version 23H2: 10.0.22631.0 before 10.0.22631.7652
- Windows 11 Version 24H2: 10.0.26100.0 before 10.0.26100.9711
- Windows 11 Version 25H2: 10.0.26200.0 before 10.0.26200.9711
- Windows 11 Version 26H1: 10.0.28000.0 before 10.0.28000.3231
- Windows 11 Version 26H2: 10.0.26300.0 before 10.0.26300.9711
- Windows Server 2012 (including Server Core): 6.2.9200.0 before 6.2.9200.26434
- Windows Server 2012 R2 (including Server Core): 6.3.9600.0 before 6.3.9600.23470
- Windows Server 2016: 10.0.14393.0 before 10.0.14393.9612
Fixed in
Microsoft has published security updates for the affected versions. According to the CVE record, the fixed builds are:
- Windows 10 1607: 10.0.14393.9612
- Windows 10 1809: 10.0.17763.9376
- Windows 10 21H2: 10.0.19044.7807
- Windows 10 22H2: 10.0.19045.7807
- Windows 11 23H2: 10.0.22631.7652
- Windows 11 24H2 and 25H2, Windows 11 26H2: 10.0.26100.9711 and 10.0.26200.9711 and 10.0.26300.9711
- Windows 11 26H1: 10.0.28000.3231
- Windows Server 2012: 6.2.9200.26434
- Windows Server 2012 R2: 6.3.9600.23470
- Windows Server 2016: 10.0.14393.9612
Verify the exact update per product on the MSRC advisory. No AMD advisory was found.
Workaround
Unknown. No workaround has been identified; the Windows security update is the remedy.
Exploitation
- Microsoft reports no public disclosure and assesses exploitation as less likely.
- CISA SSVC: exploitation none, not automatable, partial technical impact.
- No public proof of concept is known. Status as of 10 November 2026; it can change.
Our recommendation
- Install the November 2026 Windows cumulative update on all affected systems through normal patching.
- Prioritise terminal servers, Remote Desktop hosts, shared VDI and multi-user systems.
- Check whether untrusted local users or malware running as a user could reach these systems.
- Monitor the MSRC advisory and the NVD entry for changes.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Information disclosure – AMD Zen
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5127648, KB5126651, KB5126655, KB5126657, KB5126646, KB5126653
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-84004 msrc.microsoft.com
- CVE Record CVE-2026-84004 www.cve.org
- Rapid7: Patch Tuesday November 2026 www.rapid7.com
- BleepingComputer: Microsoft November 2026 Patch Tuesday www.bleepingcomputer.com
- OffSeq Radar: CVE-2026-84004 radar.offseq.com
- Strix: CVE-2026-84004 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:39.
Original description (NVD)
Processor optimization removal or modification of security-critical code in AMD Zen allows an authorized attacker to disclose information locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.