{"id":"CVE-2026-57882","kind":"vulnerability","aliases":["CVE-2026-57882"],"related":[],"title":"Intel server boards: UEFI firmware write flaw allows privilege escalation locally","description":"Out-of-bounds write in the XmlCliCommonDxe for the Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP within Ring 0 UEFI may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts.","summary":"An out-of-bounds write in the XmlCliCommonDxe firmware component of Intel Server Boards D50DNP and M50FCP lets a privileged local user run code at firmware level. An attacker who gets that access can take full control of confidentiality, integrity and availability of the machine.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Intel Server Board D50DNP and M50FCP UEFI","fixed":["R01.02.0006"],"affected":"< R01.02.0006","ecosystem":"vendor"}],"ecosystems":[],"tags":["bios","d50dnp","infrastructure","intel","m50fcp","server-firmware","uefi"],"not_affected_if":["no-local-access","other-server-boards"],"how_to_check":"Identify servers with Intel Server Board D50DNP or M50FCP (board model in BIOS/inventory). Read the installed UEFI/BIOS version; versions before R01.02.0006 are affected.","fix":"Update Intel Server Board D50DNP and M50FCP UEFI to version R01.02.0006 or later (Intel download pages linked from INTEL-SA-01554).","status":"open","published_at":"2026-11-10T18:17:41+00:00","first_seen_at":"2026-11-10T18:22:59+00:00","triaged_at":"2026-11-10T18:24:19+00:00","updated_at":"2026-11-10T18:26:47+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-10T18:24:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Intel server boards: UEFI firmware write flaw allows privilege escalation locally","impact":"high","summary":"An out-of-bounds write in the XmlCliCommonDxe firmware component of Intel Server Boards D50DNP and M50FCP lets a privileged local user run code at firmware level. An attacker who gets that access can take full control of confidentiality, integrity and availability of the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["intel","server-firmware","uefi","bios"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Local attacker runs code in firmware and takes full control of the server","analyst_note":"Find Intel's security advisory for this CVE to confirm the affected BIOS/firmware versions and the fixed release.","how_to_check":"- Identify whether any server runs an Intel Server Board D50DNP or M50FCP, for example from the board model in the BIOS or from the vendor inventory.\n- Check the installed BIOS/UEFI firmware version against Intel's security advisory for these boards; the sources do not give the affected version ranges.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-server-boards","no-local-access"],"who_is_affected":"Only systems running Intel Server Board D50DNP or M50FCP firmware with the affected XmlCliCommonDxe component are exposed. The attacker needs local access and a privileged user position, and a high-complexity condition must be met. Teams without these boards can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000771,"input_tokens":4693,"output_tokens":603,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Intel's security advisory for this CVE to confirm the affected BIOS/firmware versions and the fixed release.","search":"'-2026':13A,16A '-57882':14A,17A '0':103C 'access':67B,138C 'adversari':115C 'allow':8A,106C 'and':22A 'attack':63B,125C,140C 'avail':76B,164C,179C 'bio':25B 'board':3A,20A,48B,93C,99C 'bound':38B,83C 'code':58B,112C,129C 'combin':120C 'complex':124C 'compon':44B 'confidenti':73B,159C,174C 'control':71B 'cve':12A,15A 'd50dnp':21A,26B,49B,94C 'enabl':127C 'escal':10A,108C 'execut':130C 'firmwar':5A,32B,43B,60B 'flaw':7A 'full':70B 'get':65B 'high':123C,160C,162C,165C,175C,177C,180C 'impact':157C,181C 'infrastructur':27B 'integr':74B,161C,176C 'intel':1A,18A,28B,46B,90C,96C 'interact':152C 'intern':146C 'knowledg':147C 'let':52B 'level':61B 'local':11A,55B,128C,137C 'm50fcp':23A,29B,51B,100C 'machin':79B 'may':105C,126C,133C,156C 'occur':135C 'out-of-bound':35B,80C 'potenti':134C,154C 'present':143C 'privileg':9A,54B,110C,118C 'r':91C,97C 'requir':141C,149C 'result':132C,170C 'ring':102C 'run':57B 'server':2A,19A,31B,47B,92C,98C 'server-firmwar':30B 'smm':114C 'special':145C 'startup':111C 'subsequ':172C 'system':169C,173C 'take':69B 'uefi':4A,24A,33B,104C 'user':56B,119C,151C 'via':136C 'vulner':155C,168C 'within':101C 'without':144C 'write':6A,39B,84C 'xmlclicommondx':42B,87C","nicknames":[],"mitigations":[],"who_affected":"Servers using Intel Server Board D50DNP or M50FCP running UEFI firmware before R01.02.0006. Exploitation needs local access with a privileged user and a high-complexity attack, so the risk is mostly to shared or multi-tenant hosts where an attacker already has admin rights. Everyone not running these boards can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T18:26:47Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html","run_id":2493},"products":{"at":"2026-11-10T18:26:47Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html","run_id":2493},"how_to_check":{"at":"2026-11-10T18:26:47Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html","run_id":2493},"who_affected":{"at":"2026-11-10T18:26:47Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html","run_id":2493}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["intelserverboardd50dnpandm50fcpuefi","serverboardd50dnpandm50fcpuefi"],"ptokens":["and","board","d50dnp","intel","m50fcp","server","uefi"],"labels":["bios","d50dnp","high","infrastructure","intel","m50fcp","serverfirmware","uefi"],"campaign_type":null,"search_a":"'-2026':13A,16A '-57882':14A,17A 'allow':8A 'and':22A 'board':3A,20A 'cve':12A,15A 'd50dnp':21A 'escal':10A 'firmwar':5A 'flaw':7A 'intel':1A,18A 'local':11A 'm50fcp':23A 'privileg':9A 'server':2A,19A 'uefi':4A,24A 'write':6A","search_b":"'access':67B 'attack':63B 'avail':76B 'bio':25B 'board':48B 'bound':38B 'code':58B 'compon':44B 'confidenti':73B 'control':71B 'd50dnp':26B,49B 'firmwar':32B,43B,60B 'full':70B 'get':65B 'infrastructur':27B 'integr':74B 'intel':28B,46B 'let':52B 'level':61B 'local':55B 'm50fcp':29B,51B 'machin':79B 'out-of-bound':35B 'privileg':54B 'run':57B 'server':31B,47B 'server-firmwar':30B 'take':69B 'uefi':33B 'user':56B 'write':39B 'xmlclicommondx':42B","search_c":"'0':103C 'access':138C 'adversari':115C 'allow':106C 'attack':125C,140C 'avail':164C,179C 'board':93C,99C 'bound':83C 'code':112C,129C 'combin':120C 'complex':124C 'confidenti':159C,174C 'd50dnp':94C 'enabl':127C 'escal':108C 'execut':130C 'high':123C,160C,162C,165C,175C,177C,180C 'impact':157C,181C 'integr':161C,176C 'intel':90C,96C 'interact':152C 'intern':146C 'knowledg':147C 'local':128C,137C 'm50fcp':100C 'may':105C,126C,133C,156C 'occur':135C 'out-of-bound':80C 'potenti':134C,154C 'present':143C 'privileg':110C,118C 'r':91C,97C 'requir':141C,149C 'result':132C,170C 'ring':102C 'server':92C,98C 'smm':114C 'special':145C 'startup':111C 'subsequ':172C 'system':169C,173C 'uefi':104C 'user':119C,151C 'via':136C 'vulner':155C,168C 'within':101C 'without':144C 'write':84C 'xmlclicommondx':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T18:17:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"secure@intel.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57882","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57882","severity":null,"published_at":"2026-11-10T18:17:41+00:00","modified_at":"2026-11-10T18:17:41+00:00","first_seen_at":"2026-11-10T18:22:59+00:00","fetched_at":"2026-11-10T18:22:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-57882:2493","url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html","severity":null,"published_at":"2026-11-10T18:26:47+00:00","modified_at":"2026-11-10T18:26:47+00:00","first_seen_at":"2026-11-10T18:26:47+00:00","fetched_at":"2026-11-10T18:26:47+00:00","note":"Read Intel INTEL-SA-01554 (11/10/2026): CVE listed, affected UEFI before R01.02.0006, fixed R01.02.0006. No exploitation/PoC info; no social search done (local, privileged, firmware).","cites":["https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html"]}],"documents":[{"id":117052,"url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html","title":"INTEL-SA-01554 Intel Server Board D50DNP and M50FCP UEFI Firmware Advisory","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}