{"id":"CVE-2026-57891","kind":"vulnerability","aliases":["CVE-2026-57891"],"related":[],"title":"Intel server boards: UEFI firmware write flaw lets privileged users run code","description":"Out-of-bounds write in the XmlCliCommonDxe for the Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP within Ring 0 UEFI may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts.","summary":"Out-of-bounds write in the XmlCliCommonDxe UEFI component of Intel Server Board D50DNP and M50FCP. A privileged local attacker with a high-complexity attack may achieve local code execution at firmware level. Intel rates it CVSS 4.0 8.7 High and fixes it in UEFI R01.02.0006.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Intel Server Board D50DNP","fixed":["R01.02.0006"],"affected":"UEFI < R01.02.0006","ecosystem":"vendor"},{"name":"Intel Server Board M50FCP","fixed":["R01.02.0006"],"affected":"UEFI < R01.02.0006","ecosystem":"vendor"}],"ecosystems":[],"tags":["bios","infrastructure","intel","local-privilege-escalation","server-firmware","uefi"],"not_affected_if":["no-local-access","other-server-boards"],"how_to_check":"Confirm whether the server is an Intel Server Board D50DNP or M50FCP. Read the installed UEFI/BIOS version (BMC, UEFI setup screen, or dmidecode -s bios-version on Linux). Versions before R01.02.0006 are affected.","fix":"Update Intel Server Board D50DNP and M50FCP to UEFI version R01.02.0006 or later (download links on INTEL-SA-01554).","status":"open","published_at":"2026-11-10T18:17:42+00:00","first_seen_at":"2026-11-10T18:22:59+00:00","triaged_at":"2026-11-10T18:24:19+00:00","updated_at":"2026-11-10T18:26:07+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-10T18:24:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Intel server boards: UEFI firmware write flaw lets privileged users run code","impact":"high","summary":"An out-of-bounds write in the XmlCliCommonDxe UEFI firmware component of certain Intel server boards can let a privileged local user escalate privileges. A successful attack could allow local code execution at the firmware level with high impact to confidentiality, integrity and availability.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["intel","server-firmware","uefi","bios"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker gains firmware-level code execution and full system control","analyst_note":"Find Intel's security advisory for this CVE to get affected and fixed firmware versions and the vendor-stated fix.","how_to_check":"- Identify whether the server runs an Intel Server Board D50DNP or M50FCP.\n- Check the current BIOS/UEFI firmware version against Intel's security advisory for this CVE; the sources do not give a version.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-server-boards","no-local-access"],"who_is_affected":"Servers built on Intel Server Board D50DNP or M50FCP are the relevant systems; the flaw needs local access with a privileged user and a high-complexity attack. The sources do not say which firmware versions are affected, so teams should confirm against Intel's advisory. Systems without these boards are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000759,"input_tokens":4688,"output_tokens":581,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Intel's security advisory for this CVE to get affected and fixed firmware versions and the vendor-stated fix.","search":"'-2026':14A,17A '-57891':15A,18A '0':109C '4.0':77B '8.7':78B 'access':142C 'achiev':66B 'adversari':119C 'allow':112C 'attack':58B,64B,129C,144C 'avail':168C,183C 'bio':27B 'board':3A,21A,25A,51B,99C,105C 'bound':41B,89C 'code':12A,68B,133C 'combin':124C 'complex':63B,128C 'compon':47B 'confidenti':163C,178C 'cve':13A,16A 'cvss':76B 'd50dnp':22A,52B,100C 'enabl':131C 'escal':33B,114C 'execut':69B,134C 'firmwar':5A,36B,71B 'fix':81B 'flaw':7A 'high':62B,79B,127C,164C,166C,169C,179C,181C,184C 'high-complex':61B 'impact':161C,185C 'infrastructur':28B 'integr':165C,180C 'intel':1A,19A,23A,29B,49B,73B,96C,102C 'interact':156C 'intern':150C 'knowledg':151C 'let':8A 'level':72B 'local':31B,57B,67B,132C,141C 'local-privilege-escal':30B 'm50fcp':26A,54B,106C 'may':65B,111C,130C,137C,160C 'occur':139C 'out-of-bound':38B,86C 'potenti':138C,158C 'present':147C 'privileg':9A,32B,56B,116C,122C 'r':97C,103C 'r01.02.0006':85B 'rate':74B 'requir':145C,153C 'result':136C,174C 'ring':108C 'run':11A 'server':2A,20A,24A,35B,50B,98C,104C 'server-firmwar':34B 'softwar':118C 'special':149C 'subsequ':176C 'system':117C,173C,177C 'uefi':4A,37B,46B,84B,110C 'user':10A,123C,155C 'via':140C 'vulner':159C,172C 'within':107C 'without':148C 'write':6A,42B,90C 'xmlclicommondx':45B,93C","nicknames":[],"mitigations":[],"who_affected":"Only servers built on Intel Server Board D50DNP or M50FCP running UEFI before R01.02.0006. The attacker needs local privileged access and a high-complexity attack, so exposure matters mostly on shared or multi-tenant hosts or where an admin account could be compromised. Everyone else can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T18:26:07Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html","run_id":2491},"products":{"at":"2026-11-10T18:26:07Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html","run_id":2491},"how_to_check":{"at":"2026-11-10T18:26:07Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html","run_id":2491},"who_affected":{"at":"2026-11-10T18:26:07Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html","run_id":2491}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["intelserverboardd50dnp","intelserverboardm50fcp","serverboardd50dnp","serverboardm50fcp"],"ptokens":["board","d50dnp","intel","m50fcp","server"],"labels":["bios","high","infrastructure","intel","localprivilegeescalation","serverfirmware","uefi"],"campaign_type":null,"search_a":"'-2026':14A,17A '-57891':15A,18A 'board':3A,21A,25A 'code':12A 'cve':13A,16A 'd50dnp':22A 'firmwar':5A 'flaw':7A 'intel':1A,19A,23A 'let':8A 'm50fcp':26A 'privileg':9A 'run':11A 'server':2A,20A,24A 'uefi':4A 'user':10A 'write':6A","search_b":"'4.0':77B '8.7':78B 'achiev':66B 'attack':58B,64B 'bio':27B 'board':51B 'bound':41B 'code':68B 'complex':63B 'compon':47B 'cvss':76B 'd50dnp':52B 'escal':33B 'execut':69B 'firmwar':36B,71B 'fix':81B 'high':62B,79B 'high-complex':61B 'infrastructur':28B 'intel':29B,49B,73B 'level':72B 'local':31B,57B,67B 'local-privilege-escal':30B 'm50fcp':54B 'may':65B 'out-of-bound':38B 'privileg':32B,56B 'r01.02.0006':85B 'rate':74B 'server':35B,50B 'server-firmwar':34B 'uefi':37B,46B,84B 'write':42B 'xmlclicommondx':45B","search_c":"'0':109C 'access':142C 'adversari':119C 'allow':112C 'attack':129C,144C 'avail':168C,183C 'board':99C,105C 'bound':89C 'code':133C 'combin':124C 'complex':128C 'confidenti':163C,178C 'd50dnp':100C 'enabl':131C 'escal':114C 'execut':134C 'high':127C,164C,166C,169C,179C,181C,184C 'impact':161C,185C 'integr':165C,180C 'intel':96C,102C 'interact':156C 'intern':150C 'knowledg':151C 'local':132C,141C 'm50fcp':106C 'may':111C,130C,137C,160C 'occur':139C 'out-of-bound':86C 'potenti':138C,158C 'present':147C 'privileg':116C,122C 'r':97C,103C 'requir':145C,153C 'result':136C,174C 'ring':108C 'server':98C,104C 'softwar':118C 'special':149C 'subsequ':176C 'system':117C,173C,177C 'uefi':110C 'user':123C,155C 'via':140C 'vulner':159C,172C 'within':107C 'without':148C 'write':90C 'xmlclicommondx':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T18:17:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"secure@intel.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57891","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57891","severity":null,"published_at":"2026-11-10T18:17:42+00:00","modified_at":"2026-11-10T18:17:42+00:00","first_seen_at":"2026-11-10T18:22:59+00:00","fetched_at":"2026-11-10T18:22:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-57891:2491","url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html","severity":null,"published_at":"2026-11-10T18:26:07+00:00","modified_at":"2026-11-10T18:26:07+00:00","first_seen_at":"2026-11-10T18:26:07+00:00","fetched_at":"2026-11-10T18:26:07+00:00","note":"Read Intel INTEL-SA-01554 (released 2026-11-10): CVE-2026-57891 is one of five CVEs; affected UEFI before R01.02.0006 on D50DNP and M50FCP; fix R01.02.0006 or later. No exploitation or PoC stated by Intel.","cites":["https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html"]}],"documents":[{"id":117052,"url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html","title":"INTEL-SA-01554 Intel Server Board D50DNP and M50FCP UEFI Firmware Advisory","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}