# Critical Intel and AMD Vulnerabilities Expose Data Center Infrastructure; 70 Flaws Patched in Coordinated Chipmaker Release
## The Threat
Intel and AMD have released a coordinated wave of security updates addressing 70 vulnerabilities spanning their processor platforms, drivers, and firmware—including two critical flaws that could allow remote attackers to seize control of virtualized systems and AI accelerator infrastructure.
The coordinated patch cycle underscores a troubling shift in vulnerability severity: both chip giants disclosed critical-severity vulnerabilities this month, a relatively uncommon occurrence that reflects the expanding attack surface in modern compute stacks. Where processors themselves were once considered relatively stable, today's threats target the entire ecosystem: virtualization drivers, GPU management interfaces, and firmware layers that organizations often treat as trusted but rarely patch systematically.
Intel addressed 24 vulnerabilities across 13 advisories, while AMD disclosed 45 vulnerabilities in 15 separate notices. The most dangerous flaws expose virtualized data centers and GPU clusters—precisely the infrastructure that powers cloud providers, AI model training operations, and enterprise virtualization farms. Organizations running VMware ESXi environments or GPU-accelerated workloads are particularly exposed.
## Severity and Impact
| CVE ID | Product/Component | CVSS Score | Severity | Attack Vector | Authentication | Primary Impact |
|--------|-------------------|-----------|----------|----------------|-----------------|-----------------|
| CVE-2026-20794 | Intel Data Center Graphics Driver (VMware ESXi) | 9.3 | Critical | Local/Network | Not Required | Privilege Escalation, Code Execution |
| CVE-2026-0481 | AMD Device Metrics Exporter (ROCm) | 9.2 | Critical | Network | Not Required | Unauthorized GPU Configuration, Availability Loss |
| CVE-2026-[Intel High] | Intel Vision, EMA, Bootloader, QAT | 8.1–8.8 | High | Multiple | Varies | Privilege Escalation, DoS, Data Disclosure |
| CVE-2026-[AMD High] | AMD ASP, GPIO, Chipset, RAID, EPYC | 8.0–8.9 | High | Multiple | Varies | Privilege Escalation, Code Execution, Arbitrary Read/Write |
Critical Vulnerability Details:
CVE-2026-20794 manifests as a buffer overflow in Intel's Data Center Graphics Driver, exploitable through the VMware ESXi hypervisor. A local attacker—or an attacker with network access to an improperly isolated ESXi host—can trigger the overflow to escalate privileges or execute arbitrary code with hypervisor-level permissions. This exposure is particularly severe because successful exploitation grants control over all virtual machines running on that ESXi host.
CVE-2026-0481 affects AMD's Device Metrics Exporter, a critical component in the ROCm GPU computing ecosystem. The vulnerability stems from unrestricted IP address binding on port 50061, exposing an unauthenticated gRPC interface to all network interfaces by default. A remote attacker requires no credentials to reconfigure GPU parameters, potentially disrupting compute jobs, exfiltrating data from GPU memory, or creating denial-of-service conditions across AI training pipelines.
## Affected Products
Intel:
AMD:
## Mitigations
Immediate Actions (This Week):
Short-Term (Within 30 Days):
Network Segmentation:
Firmware and BIOS Updates:
## References
---
## HackWire Analysis
This coordinated patch cycle marks a significant inflection point in infrastructure security. For years, vulnerability severity concentrated in application layers—browsers, databases, web frameworks. Today's critical flaws target the physical substrate: chips, drivers, and GPU coordinators that organizations treat as immutable.
AMD's ROCm exposure is particularly telling. The vulnerability—an unauthenticated gRPC interface binding to all network interfaces by default—reflects the rush to operationalize GPU clusters without security hardening. As organizations scale AI training and inference workloads, GPU management infrastructure has become security-critical but remains immature. Similar patterns emerged with Kubernetes and container orchestration five years ago; defenders learned that convenience often displaces security in new infrastructure domains.
The VMware ESXi graphics driver vulnerability carries different implications. Hypervisor-level code execution is exceptionally dangerous because it grants control over all tenant VMs. Cloud providers, hosting companies, and any organization running multi-tenant ESXi environments faces potential lateral movement across customers—a blast radius that single-system vulnerabilities rarely achieve.
What's missing from vendor advisories: evidence of active exploitation. Critical vulnerabilities with open exploit paths often see attack-in-the-wild within weeks if proof-of-concept code is released. Organizations should assume these will be weaponized. Defenders should triage patching by exposure surface: externally-accessible GPU clusters and virtualization management interfaces first, internal systems second.
The broader pattern: chipmaker vulnerabilities are shifting from theoretical to immediately exploitable, and patch cycles are compressing. This is the new normal. — *HackWire Editorial*
## Related Coverage