---
id: "CVE-2026-57891"
page: "https://infrastack.ai/live/CVE-2026-57891"
kind: "vulnerability"
aliases: ["CVE-2026-57891"]
title: "Intel server boards: UEFI firmware write flaw lets privileged users run code"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Intel Server Board D50DNP", "fixed": ["R01.02.0006"], "affected": "UEFI < R01.02.0006", "ecosystem": "vendor"}, {"name": "Intel Server Board M50FCP", "fixed": ["R01.02.0006"], "affected": "UEFI < R01.02.0006", "ecosystem": "vendor"}]
ecosystems: []
tags: ["bios", "infrastructure", "intel", "local-privilege-escalation", "server-firmware", "uefi"]
not_affected_if: ["no-local-access", "other-server-boards"]
published_at: "2026-11-10T18:17:42+00:00"
first_seen_at: "2026-11-10T18:22:59+00:00"
updated_at: "2026-11-10T18:26:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57891", "first_seen_at": "2026-11-10T18:22:59+00:00"}, {"source": "analyst", "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html", "first_seen_at": "2026-11-10T18:26:07+00:00", "cites": ["https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html"]}]
exploit_sources: []
---

# Intel server boards: UEFI firmware write flaw lets privileged users run code

Link for people: https://infrastack.ai/live/CVE-2026-57891 (this .md is for agents)

Out-of-bounds write in the XmlCliCommonDxe UEFI component of Intel Server Board D50DNP and M50FCP. A privileged local attacker with a high-complexity attack may achieve local code execution at firmware level. Intel rates it CVSS 4.0 8.7 High and fixes it in UEFI R01.02.0006.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Intel Server Board D50DNP affected UEFI < R01.02.0006 fixed R01.02.0006
- vendor:Intel Server Board M50FCP affected UEFI < R01.02.0006 fixed R01.02.0006

## How to check

Confirm whether the server is an Intel Server Board D50DNP or M50FCP. Read the installed UEFI/BIOS version (BMC, UEFI setup screen, or dmidecode -s bios-version on Linux). Versions before R01.02.0006 are affected.

## Fix

Update Intel Server Board D50DNP and M50FCP to UEFI version R01.02.0006 or later (download links on INTEL-SA-01554).

## Timeline

- 2026-11-10T18:22:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-57891
- 2026-11-10T18:26:07+00:00 analyst https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html — Read Intel INTEL-SA-01554 (released 2026-11-10): CVE-2026-57891 is one of five CVEs; affected UEFI before R01.02.0006 on D50DNP and M50FCP; fix R01.02.0006 or later. No exploitation or PoC stated by Intel.

## Documents

- [advisory] INTEL-SA-01554 Intel Server Board D50DNP and M50FCP UEFI Firmware Advisory https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01554.html

## From the sources

Out-of-bounds write in the XmlCliCommonDxe for the Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP within Ring 0 UEFI may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_