{"id":"CVE-2026-56435","kind":"vulnerability","aliases":["CVE-2026-56435"],"related":[],"title":"Intel server boards: UEFI firmware flaw lets a local user escalate privileges","description":"Out-of-bounds write in the XmlCliCommonDxe for the Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP within Ring 0 UEFI may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts.","summary":"An out-of-bounds write in the XmlCliCommonDxe firmware component of Intel Server Board D50DNP and M50FCP lets a privileged local user run code at the firmware level. A successful attack can give full control of the machine and its data.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Intel Server Board D50DNP UEFI","fixed":["R01.02.0006"],"affected":"< R01.02.0006","ecosystem":"vendor"},{"name":"Intel Server Board M50FCP UEFI","fixed":["R01.02.0006"],"affected":"< R01.02.0006","ecosystem":"vendor"}],"ecosystems":[],"tags":["bios","infrastructure","intel","server-firmware","uefi"],"not_affected_if":["no-local-access","other-server-boards"],"how_to_check":"- Identify whether the server uses an Intel Server Board D50DNP or M50FCP (board model in the BMC or asset inventory).\n- Read the installed UEFI/BIOS version (BMC firmware inventory or setup screen). Versions before R01.02.0006 are affected; R01.02.0006 or later is fixed.","fix":"Update Intel Server Board D50DNP and M50FCP to UEFI version R01.02.0006 or later (Intel INTEL-SA-01554).","status":"open","published_at":"2026-11-10T18:17:41+00:00","first_seen_at":"2026-11-10T18:22:59+00:00","triaged_at":"2026-11-10T18:24:20+00:00","updated_at":"2026-11-10T18:27:03+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-10T18:24:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Intel server boards: UEFI firmware flaw lets a local user escalate privileges","impact":"high","summary":"An out-of-bounds write in the XmlCliCommonDxe firmware component of Intel Server Board D50DNP and M50FCP lets a privileged local user run code at the firmware level. A successful attack can give full control of the machine and its data.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["intel","server-firmware","uefi","bios"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker runs code at firmware level, full system compromise","analyst_note":"Find Intel's security advisory for this CVE and check which BIOS/UEFI firmware versions fix the XmlCliCommonDxe flaw on D50DNP and M50FCP.","how_to_check":"- Identify whether the server runs an Intel Server Board D50DNP or M50FCP, for example from the board model in the BMC or asset inventory.\n- Compare the installed BIOS/UEFI firmware version against the vendor's advisory; the sources do not name affected firmware versions.","plain_action":"","product_name":"Intel Server Board D50DNP and M50FCP XmlCliCommonDxe firmware","needs_analyst":true,"not_affected_if":["other-server-boards","no-local-access"],"who_is_affected":"Only servers built on Intel Server Board D50DNP or M50FCP with the affected XmlCliCommonDxe firmware are exposed. The attack needs local access and a privileged user, plus a high-complexity condition, so machines reachable only by trusted administrators carry less risk. Teams running other Intel or non-Intel boards can skip it.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.0008,"input_tokens":4693,"output_tokens":662,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Intel's security advisory for this CVE and check which BIOS/UEFI firmware versions fix the XmlCliCommonDxe flaw on D50DNP and M50FCP.","search":"'-2026':14A,17A '-56435':15A,18A '0':101C 'access':136C 'adversari':113C 'allow':104C 'attack':67B,123C,138C 'avail':162C,177C 'bio':29B 'board':3A,21A,26A,50B,91C,97C 'bound':40B,81C 'code':60B,110C,127C 'combin':118C 'complex':122C 'compon':46B 'confidenti':157C,172C 'control':71B 'cve':13A,16A 'd50dnp':22A,51B,92C 'data':77B 'enabl':125C 'escal':11A,106C 'execut':128C 'firmwar':5A,34B,45B,63B 'flaw':6A 'full':70B 'give':69B 'high':121C,158C,160C,163C,173C,175C,178C 'impact':155C,179C 'infrastructur':30B 'integr':159C,174C 'intel':1A,19A,24A,31B,48B,88C,94C 'interact':150C 'intern':144C 'knowledg':145C 'let':7A,54B 'level':64B 'local':9A,57B,126C,135C 'm50fcp':27A,53B,98C 'machin':74B 'may':103C,124C,131C,154C 'occur':133C 'out-of-bound':37B,78C 'potenti':132C,152C 'present':141C 'privileg':12A,56B,108C,116C 'r':89C,95C 'requir':139C,147C 'result':130C,168C 'ring':100C 'run':59B 'server':2A,20A,25A,33B,49B,90C,96C 'server-firmwar':32B 'smm':112C 'special':143C 'startup':109C 'subsequ':170C 'success':66B 'system':167C,171C 'uefi':4A,23A,28A,35B,102C 'user':10A,58B,117C,149C 'via':134C 'vulner':153C,166C 'within':99C 'without':142C 'write':41B,82C 'xmlclicommondx':44B,85C","nicknames":[],"mitigations":[],"who_affected":"Only servers built on Intel Server Board D50DNP or M50FCP with the affected XmlCliCommonDxe firmware are exposed. The attack needs local access and a privileged user, plus a high-complexity condition, so machines reachable only by trusted administrators carry less risk. Teams running other Intel or non-Intel boards can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T18:27:03Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html","run_id":2494},"products":{"at":"2026-11-10T18:27:03Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html","run_id":2494},"how_to_check":{"at":"2026-11-10T18:27:03Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html","run_id":2494}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["intelserverboardd50dnpuefi","intelserverboardm50fcpuefi","serverboardd50dnpuefi","serverboardm50fcpuefi"],"ptokens":["board","d50dnp","intel","m50fcp","server","uefi"],"labels":["bios","high","infrastructure","intel","serverfirmware","uefi"],"campaign_type":null,"search_a":"'-2026':14A,17A '-56435':15A,18A 'board':3A,21A,26A 'cve':13A,16A 'd50dnp':22A 'escal':11A 'firmwar':5A 'flaw':6A 'intel':1A,19A,24A 'let':7A 'local':9A 'm50fcp':27A 'privileg':12A 'server':2A,20A,25A 'uefi':4A,23A,28A 'user':10A","search_b":"'attack':67B 'bio':29B 'board':50B 'bound':40B 'code':60B 'compon':46B 'control':71B 'd50dnp':51B 'data':77B 'firmwar':34B,45B,63B 'full':70B 'give':69B 'infrastructur':30B 'intel':31B,48B 'let':54B 'level':64B 'local':57B 'm50fcp':53B 'machin':74B 'out-of-bound':37B 'privileg':56B 'run':59B 'server':33B,49B 'server-firmwar':32B 'success':66B 'uefi':35B 'user':58B 'write':41B 'xmlclicommondx':44B","search_c":"'0':101C 'access':136C 'adversari':113C 'allow':104C 'attack':123C,138C 'avail':162C,177C 'board':91C,97C 'bound':81C 'code':110C,127C 'combin':118C 'complex':122C 'confidenti':157C,172C 'd50dnp':92C 'enabl':125C 'escal':106C 'execut':128C 'high':121C,158C,160C,163C,173C,175C,178C 'impact':155C,179C 'integr':159C,174C 'intel':88C,94C 'interact':150C 'intern':144C 'knowledg':145C 'local':126C,135C 'm50fcp':98C 'may':103C,124C,131C,154C 'occur':133C 'out-of-bound':78C 'potenti':132C,152C 'present':141C 'privileg':108C,116C 'r':89C,95C 'requir':139C,147C 'result':130C,168C 'ring':100C 'server':90C,96C 'smm':112C 'special':143C 'startup':109C 'subsequ':170C 'system':167C,171C 'uefi':102C 'user':117C,149C 'via':134C 'vulner':153C,166C 'within':99C 'without':142C 'write':82C 'xmlclicommondx':85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T18:17:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"secure@intel.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-56435","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56435","severity":null,"published_at":"2026-11-10T18:17:41+00:00","modified_at":"2026-11-10T18:17:41+00:00","first_seen_at":"2026-11-10T18:22:59+00:00","fetched_at":"2026-11-10T18:22:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-56435:2494","url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html","severity":null,"published_at":"2026-11-10T18:27:03+00:00","modified_at":"2026-11-10T18:27:03+00:00","first_seen_at":"2026-11-10T18:27:03+00:00","fetched_at":"2026-11-10T18:27:03+00:00","note":"Intel INTEL-SA-01554 (11/10/2026) read: affected UEFI before R01.02.0006 on D50DNP and M50FCP, fix R01.02.0006 or later. Also covers CVE-2026-57882, -57891, -55716, -50249. No exploitation or PoC stated. Download links not captured in page text.","cites":["https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html"]}],"documents":[{"id":117052,"url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html","title":"INTEL-SA-01554 Intel Server Board D50DNP and M50FCP UEFI Firmware Advisory","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}