AMD's November pages, counted: 31 items, 100 unique CVEs, mitigation dates from 2020 to a planned April 2027
AMD's own listing, counted, has 31 items dated 9 and 10 November 2026 holding 148 CVE entries but 100 unique CVEs, with mitigation dates from 2020 to a planned April 2027. Intel's advisory could not be read; one Intel CVE record, rated 9.4 Critical, was.
By Parminder Kumar Sharma · LinkedIn · · 19 min read
AMD's own pages list 148 CVE entries but only 100 unique CVEs, in 31 items
AMD's product security listing shows 31 items dated 9 or 10 November 2026: 29 security bulletins and two security briefs. Their CVE columns hold 148 CVE entries, but only 100 unique CVE identifiers, because 27 of them appear in more than one item and 20 appear in three graphics bulletins at once (all derived by this site). The trade press report SecurityWeek, published at 3:42 AM ET on 11 November (08:42 UTC, from its page data), says AMD published "29 security bulletins and two security briefs" covering "roughly 100 unique CVEs". The two agree, but only when the one bulletin dated 9 November is counted: 28 bulletins carry the date 10 November. Everything here is as read between 10:11 and 10:22 UTC on Wednesday 11 November 2026.
What that does not establish: how many flaws there are, because "flaws", "issues", "CVE entries" and "unique CVEs" are four different counts, and whether any of them is being exploited. No AMD bulletin read says anything about exploitation (derived by text search of all 31). None of the 100 identifiers, nor Intel's CVE-2026-61887, is in the CISA Known Exploited Vulnerabilities catalogue, version 2026.11.10, released at 19:03 UTC on 10 November (derived). SecurityWeek's own headline figure, over 200 vulnerabilities from more than 50 advisories, is, on SecurityWeek's own account, the two vendors' counts together, and the Intel count rests on SecurityWeek alone.
Intel's own advisories could not be read. Intel's robots.txt answered this client with HTTP 403 and an "Access Denied" error page, not a list of rules, so no Intel page was fetched and nothing was done to get past it. The only Intel primary read is one CVE record, CVE-2026-61887, published by Intel as the CVE Numbering Authority, and its NVD copy. Every other Intel statement below is attributed to SecurityWeek and is unchecked.
Both vendors write the scores and the mitigation text for their own products and sell the products concerned: AMD in its bulletins, Intel as the assigner of its own CVE record. That is an interest in how a disclosure reads, stated once here.
How the headline count is built, and what each number counts
SecurityWeek is a secondary source; its figures are tested here against AMD's pages, which are primary. Where AMD's pages cannot test a figure, the table says so. Severity bands are this site's: AMD prints scores, so a 7.0 or more is called high on the usual CVSS bands, and the one bulletin that prints a word (Medium, in SB-8027) agrees.
SecurityWeek's AMD figures against AMD's listing and bulletins, as read on 11 November 2026. Counts marked derived are this site's.
| SecurityWeek says | AMD's pages show | Match |
|---|---|---|
| 29 security bulletins and two security briefs | 31 items: 28 bulletins and 2 briefs dated 10 November, plus 1 bulletin (SB-9031) dated 9 November (derived) | Yes, if 9 November is counted |
| Roughly 100 unique CVEs, some not specific to AMD | 148 CVE entries, 100 unique ids (derived); three labelled non-AMD: CVE-2026-14968, CVE-2026-18448, CVE-2026-4869 | Yes, on unique ids |
| Nothing rated critical | Highest printed score 8.9 (CVE-2024-36313). By the usual bands: 17 high, 77 medium, 5 low; one id, CVE-2026-4869, has no printed score (derived) | Yes |
| Graphics the largest share; one bulletin with 44 issues in Radeon and Instinct, ten high | SB-6028 lists 44 CVEs, ten scored 7.0 or more (derived). Four graphics titled items together hold 51 unique ids; 20 CVEs sit in three of them (derived) | Yes, with heavy overlap |
| More than two dozen medium severity SEV flaws | 25 CVE entries in five SEV bulletins, all scored between 4.0 and 6.8 (derived); a sixth SEV item is a brief with no CVE | Yes |
| Some mitigations as late as 2027 | SB-3061 prints a target of Apr'27; nine items print a target month; three items print No fix planned (derived) | Yes; No fix planned is not mentioned by SecurityWeek |
Two things in the table change what a reader should take from a headline of "over 200". First, the two briefs count as items but add no CVEs: AMD's page says a Security Brief informs of potential vulnerabilities where AMD has issued no CVE, and adds that a brief is "not necessarily an acknowledgement that AMD products are impacted". Second, the same 20 CVEs are listed in three bulletins, for different product families, so a count by entries would give 148 for AMD where a count by identifier gives 100. SecurityWeek does not say which rule it used for either vendor, and Intel's figure cannot be tested at all.
Intel: one CVE record read, the advisory behind it unreadable
SecurityWeek says Intel published 24 advisories describing just over 100 vulnerabilities, three of them critical and 20 high, and that the largest advisory covers 30 flaws in the TDX Migration Trust Domain (MigTD) reference software, including three critical authentication issues, one of which, CVE-2026-61887, could also allow remote code execution. It adds that Intel has discontinued BigDL, will issue no patches for three medium privilege escalation bugs in it, and advises users to "uninstall it or discontinue use as soon as possible". None of that could be checked against Intel's own advisories.
What could be read is the CVE record. CVE-2026-61887 was published at 17:48 UTC on 10 November 2026 with Intel as assigner (short name intel). NVD's copy was published at 18:17 UTC, 29 minutes 38 seconds later (derived), and when read at 10:15 UTC on 11 November NVD's status was "Received", meaning NVD has not yet analysed it, and its only score is Intel's, typed Secondary. Intel's score is CVSS 4.0, 9.4 Critical. The weakness is CWE-304, "Missing Critical Step in Authentication", with "Escalation of Privilege, Information Disclosure" as the impact type. The CVE ID was reserved on 14 July 2026, 119 days before publication (derived); a reservation date does not say when the flaw was found or reported.
What the CVE record and NVD state about CVE-2026-61887, and what they do not, read 11 November 2026.
| Question | Stated by the record | Not stated |
|---|---|---|
| Which component | "Intel(R) TDX Migration Trust Domain (MigTD)", in the "MigTD SPDM rebind implementation" | What MigTD is deployed in, or what the rebind step does; SecurityWeek calls MigTD reference software, the record does not |
| Which versions | "See references", default status unaffected | Any affected or fixed version; the only reference is Intel's advisory, which could not be read |
| The weakness | CWE-304; escalation of privilege and information disclosure | Which authentication step is missing |
| The attacker | "Network adversary with an unauthenticated user"; no user interaction; low complexity | Where the attacker must be; see the next paragraph |
| The score | CVSS 4.0, 9.4 Critical, vector AV:A/AC:L/AT:N/PR:N/UI:N, high impacts on both the vulnerable and the subsequent system | Any NVD or CISA score; NVD had not analysed the record |
| Exploitation | Nothing | Any report of use; the CVE is not in the CISA catalogue (version 2026.11.10) |
| The other two critical issues | Nothing | Their identifiers and scores; SecurityWeek gives none |
| Completeness of Intel's fixes | Nothing | Whether any patch is complete; no fix is described |
The record disagrees with itself on reach, and SecurityWeek adds a third wording. The description says a "network adversary" may achieve remote code execution, "via adjacent access". The vector's attack vector is Adjacent (AV:A), not Network (AV:N). SecurityWeek says "remote code execution". This briefing leaves the three as printed: the record does not say whether the attacker needs to share a network segment with the migration service, and no page read explains how a network adversary and adjacent access fit together.
Nor does any page read say what MigTD is for. The name expands to the Intel TDX Migration Trust Domain; SecurityWeek calls it reference software; the record calls the vulnerable code an implementation "within Ring 0: Hypervisor", a phrase it does not explain. A reader who runs Intel TDX hosts should not conclude from these pages whether their deployment includes the component. That needs Intel's advisory, which is where the record points.
The AMD items SecurityWeek names, read in the bulletins
Four of the AMD items SecurityWeek names were read in full. AMD is its own CVE Numbering Authority, so the scores are AMD's, in CVSS 4.0. One check against CVE.org: the record for CVE-2025-0008 (the Secure Debug Unlock flaw) matches the bulletin's 8.4 and vector; the records for CVE-2025-61963, CVE-2024-36313 and CVE-2026-0457 answered HTTP 404 at about 10:16 UTC on 11 November with the message that the record does not exist, so AMD's bulletins carry identifiers that CVE.org did not serve at that time (the message does not say whether they are reserved or not yet published).
The four AMD items, as the bulletins print them, read on 11 November 2026. Derived day counts run to the bulletin date, 10 November 2026.
| Item and CVE | Score and effect as printed | Mitigation dates as printed |
|---|---|---|
| SB-6028, graphics, 44 CVEs (Radeon and Instinct) | Ten scored 7.0 or more (derived), top score 8.9; "AMD has provided mitigations" | 6 Nov 2024 to 26 Aug 2026, which is 734 to 76 days before the bulletin (derived); one CVE targeted Nov'26; CVE-2026-0457 marked No fix planned |
| SB-3050, UEFI, CVE-2025-61963 | 8.4; a privileged attacker overwrites SMRAM, potentially arbitrary code execution in System Management Mode | 27 Jun 2025 to 13 Apr 2026 for the EPYC, EPYC Embedded and Instinct lines listed, 501 to 211 days before (derived); none pending |
| SB-3049, Secure Debug Unlock, CVE-2025-0008 | 8.4; a Ring 0 attacker bypasses debug access protections; "identified internally" | 29 Jan 2025 to 30 Jun 2026, 650 to 133 days before (derived); none pending |
| SB-3052, IOMMU and EDK II, CVE-2024-21954 and CVE-2026-14968 | Both 7.0; guest VM denial of service, and SMM memory corruption (the second labelled non-AMD) | 2 Dec 2025 to 28 Sep 2026 across the lines listed; none pending |
Read the dates carefully. AMD's own wording in SB-3050 is that the platform firmware versions "were released by AMD to the Original Equipment Manufacturers (OEM) on the dates listed", and that readers should "contact your OEM for the BIOS update specific to your product(s)". So a mitigation date is the day the part left AMD for the board maker, not the day any given server received a BIOS. The bulletins print no OEM date. The same pattern holds in the graphics bulletin, where the dates are driver or software releases.
The SMM flaw shows the gap best. Its bulletin appeared on 10 November 2026, and the latest mitigation date it prints, for embedded EPYC 9005, is 13 April 2026, 211 days earlier (derived); the earliest is 27 June 2025, 501 days earlier. The Secure Debug Unlock bulletin is the same: its earliest printed date is 29 January 2025. In both cases the dates show that a mitigation existed at AMD for months, or for more than a year, before the bulletin appeared (inference: the bulletin is the first public notice the pages show). That is how coordinated disclosure normally works; it is also why "advisory published" is not "fixed", and why a flaw can be new in the news and old at the vendor.
Pending, planned and not planned: three states the word mitigated hides
AMD's own policy text on the same page says why: "In most cases, however, due to eco-system and product complexity, mitigations can take longer to develop, integrate, and provide to end-users." It adds that availability and timing of remediation depend on the affected product, component, "product support period, lifecycle stage, engineering feasibility" and other considerations. The bulletins show three different states.
Entries in AMD's bulletins that are not a shipped mitigation, as printed, read 11 November 2026. Counts of bulletins are derived.
| State | Where and what | What is printed about why |
|---|---|---|
| Target month for AMD to release firmware to OEMs | Nine of 31 items: SB-3061 (Nov'26, and for embedded EPYC Jan'27, Feb'27, Apr'27), SB-3059 (Dec'26 and Feb'27), SB-7072, SB-3060, SB-5010, SB-4026, SB-4028, SB-3066, SB-6028 | A month, not a day; embedded rows print "Version TBD" for the version |
| No fix planned: RAIDXpert2, SB-7067 | CVE-2026-28235, scored 6.7, a kernel memory read by an administrator; 14 product rows, Athlon 3000 and Ryzen 3000 to 7040 and two Threadripper PRO lines | A footnote: the updated stack is "incompatible with older programs", so updates cannot be applied to these systems |
| No fix planned: graphics, SB-6028 | CVE-2026-0457, scored 5.3, cross-process information leak, many Radeon, Radeon PRO and Instinct cards | A footnote: "Restricting register access will break profilers." |
| No fix planned: Ryzen Z1 and Z2, SB-4028 | CVE-2025-62622 and CVE-2026-0472 on the Z1, Z2 and Z2 Extreme rows | No reason is printed in the saved text of the bulletin |
SecurityWeek reports that some updates are expected "as late as 2027", which the bulletins confirm: the latest month printed is Apr'27, for embedded EPYC 8004 and 9004 in SB-3061. It does not mention No fix planned, which appears in three bulletins (derived). For the SEV item, SB-3061 shows a split worth noting: AMD prints a microcode date of 2026-08-12 for the EPYC lines, 90 days before the bulletin (derived), while the BIOS release to OEMs is targeted for Nov'26. The fix that is shipped and the fix that a customer can install are different dates, and the second is not AMD's to print.
Two AMD items are not vulnerabilities in the usual sense. SB-3064 describes a RowHammer attack on SEV-SNP metadata that the researchers demonstrated on a platform with ECC disabled, and advises keeping ECC memory protection enabled. SB-7076 says a cross-core covert channel is, in AMD's assessment, a variant of known side channel techniques, and recommends constant time practices for software developers. Both are briefs and list no CVE.
What the primaries state, and what they do not
Stated and not stated across the AMD bulletins, the CVE record, NVD and CISA's catalogue, read 11 November 2026.
| Question | On the record | Not stated |
|---|---|---|
| Exploitation of any flaw | None of the 100 AMD identifiers or CVE-2026-61887 is in CISA KEV 2026.11.10; no AMD bulletin text mentions use in the wild | Whether any is used; absence from the catalogue is not a finding of safety |
| Intel's count by severity | SecurityWeek: 24 advisories, over 100 flaws, three critical, 20 high | Anything from Intel's own page; it was unreadable |
| The three critical Intel issues | One identifier and one score (9.4) in the CVE record | The other two identifiers and scores |
| What MigTD is deployed in | Nothing in the record or in SecurityWeek | Products, platforms or versions |
| Whether Intel's fixes are complete | Nothing | Any fixed version; the record says "See references" |
| Intel's BigDL | SecurityWeek only: discontinued, three medium bugs, no patches, uninstall | Anything from Intel |
| AMD's pending dates | Months as targets, from Nov'26 to Apr'27, for OEM releases | Days; OEM or customer availability |
| Date a mitigation reached a fleet | Nothing | AMD prints release dates to OEMs, not to end users |
| Why Ryzen Z1 and Z2 rows get no fix | No reason in SB-4028 | The reason, or whether the products are out of support |
Where the sources differ
These differences are left as differences. (1) SecurityWeek's 29 bulletins include one dated 9 November on AMD's listing, and SecurityWeek says AMD published them "this week"; AMD's listing dates 28 of them 10 November. (2) SecurityWeek says CVE-2026-61887 could allow remote code execution; the CVE record says a "network adversary" may enable it "via adjacent access", and scores the attack vector Adjacent. (3) SecurityWeek says there are three critical authentication issues usable for privilege escalation; the one record read gives the impact as escalation of privilege and information disclosure, and names no other CVE. (4) SecurityWeek says the EDK II bug can lead to SMM memory corruption; AMD's bulletin says successful exploitation "could lead to SMM instability or denial of service", and the CVE text says it can corrupt SMRAM. (5) AMD prints CVSS strings for three CVEs in SB-6028 with a colon after 4.0 where a slash belongs; a scanner that parses the string strictly may reject them (inference).
What to do, in order
The first three items are the vendors' own advice, attributed. The rest are this site's suggestions and each says so. The bulletins print no exploitation, so none of this is an emergency response; it is inventory and tracking work, and the order starts with Intel because its advisory is the one gap in what a reader can see.
Take this with you
Actions
- Intel, as SecurityWeek relays it: uninstall BigDL or stop using it, because no patches are being released. Confirm that from Intel's own advisory, which this site could not read.
- AMD's advice: update to the firmware, driver or software version each bulletin lists for the product, and contact the OEM for the BIOS update for platform firmware items.
- AMD's advice in SB-3064: customers using SEV-SNP should keep ECC memory protection enabled.
- This site's suggestion: read Intel's advisory yourself in a browser; the record names it as intel-sa-01580. The CVE record gives no affected or fixed version and points only to that page.
- This site's suggestion: inventory Intel TDX hosts and the MigTD version on each, since no page read says what MigTD is deployed in. Treat the 9.4 as the vendor's own score, not an assessment of your hosts.
- This site's suggestion: list your AMD platforms and match each to the bulletins by product family. Record the mitigation date the bulletin prints and the date your OEM's BIOS actually reached each host, which the bulletins do not give.
- This site's suggestion: for every bulletin row that prints a Target month, a Version TBD or No fix planned, open a tracking item with the bulletin id and the printed month, and review it when the month ends.
- This site's suggestion: for No fix planned rows (RAIDXpert2 on older Ryzen, CVE-2026-0457 on named Radeon PRO and Instinct cards, Ryzen Z1 and Z2), record a risk acceptance or plan a hardware or driver change, because the vendor has said no update is coming.
- This site's suggestion: do not mark an item fixed because an advisory exists. Record three dates: advisory, mitigation released by the vendor, mitigation installed.
- This site's suggestion: dedupe by CVE identifier before reporting a count upward, since 27 CVEs here appear in more than one bulletin.
What was read, and what was not
Read in full as saved by this site, and re-checked between 10:11 and 10:22 UTC on Wednesday 11 November 2026: SecurityWeek's article (secondary, date from its page data), AMD's product security page, the AMD bulletins and briefs it lists for 9 and 10 November (for example SB-3050, SB-3049, SB-3052, SB-6028 and SB-3061; all 31 were read), the CVE record and NVD record for CVE-2026-61887, the CVE record for CVE-2025-0008, and CISA's catalogue, version 2026.11.10. AMD's robots.txt answered 200 and does not disallow the bulletin pages; the CVE.org and NVD hosts answered 404 to robots.txt, which states no rules. Intel's robots.txt answered 403 and no Intel page was fetched. Three CVE.org records returned 404. No barred source was read, and nothing was bypassed.
Technical details
None of the pages read prints an exploit, a proof of concept, an indicator of compromise, a hash, a network address, a detection query or a log line for any of these flaws, so this section holds none. What is printed is identifiers, scores, version strings and dates, copied below. Each block is a reference for a defender to match against an asset list, not an attack aid. Internet addresses are defanged.
The Intel CVE record. The fields that matter, from the record Intel published as the CVE Numbering Authority. A defender copies the identifier into a ticket and notes that the version field says "See references" and the only reference is Intel's advisory page.
"cveId":"CVE-2026-61887","assignerOrgId":"6dda929c-bb53-4a77-a76d-48e79601a1ce","state":"PUBLISHED","assignerShortName":"intel","dateReserved":"2026-07-14T22:09:54.089Z","datePublished":"2026-11-10T17:48:06.439Z","dateUpdated":"2026-11-10T17:48:06.439Z"
"problemTypes":[{"descriptions":[{"lang":"en","description":"Escalation of Privilege, Information Disclosure"},{"lang":"en","description":"Missing Critical Step in Authentication","cweId":"CWE-304","type":"CWE"}]}]
"affected":[{"vendor":"n/a","product":"Intel(R) TDX Migration Trust Domain (MigTD)","versions":[{"version":"See references","status":"affected"}],"defaultStatus":"unaffected"}]
"references":[{"name":"hxxps://intel[.]com/content/www/us/en/security-center/advisory/intel-sa-01580.html","url":"hxxps://intel[.]com/content/www/us/en/security-center/advisory/intel-sa-01580.html"}]
The description and the vector. The description is printed in full because its wording differs from the vector: it says network adversary and adjacent access, and the vector says Adjacent.
Missing critical step in authentication in the MigTD SPDM rebind implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege and information disclosure. Network adversary with an unauthenticated user combined with a low complexity attack may enable remote code execution. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts.
"cvssV4_0":{"version":"4.0","baseScore":9.4,"baseSeverity":"CRITICAL","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE"
NVD's view. The status and the score as NVD lists them, with the source and the type. A vulnerability scanner that waits for NVD analysis will not have its own score yet.
"sourceIdentifier":"secure@intel.com","published":"2026-11-10T18:17:44.703","lastModified":"2026-11-10T18:17:44.703","vulnStatus":"Received"
"cvssMetricV40":[{"source":"secure@intel.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.4,"baseSeverity":"CRITICAL"
The AMD SMM flaw. The summary, the score and four of the platform firmware rows, laid out by this site as lines; the values are AMD's. A defender matches the product line to the PI version on the OEM's BIOS page.
AMD-SB-3050, summary: Based on the report, insufficient validation in the AmdPlatformRasSmm driver could allow a privileged (ring 0) attacker to manipulate the contents of System Management RAM (SMRAM), potentially enabling escalation to System Management Mode (SMM) and arbitrary code execution in SMM.
CVE-2025-61963 | 8.4 | CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Product | Mitigation | Mitigation Release Date
AMD EPYC™ 7001 Series Processors | NaplesPI 1.0.0.R | 2025-07-31
AMD EPYC™ 8004 Series Processors | GenoaPI 1.0.0.G | 2025-06-27
AMD EPYC™ 9005 Series Processors | TurinPI 1.0.0.6 | 2025-06-30
AMD EPYC™ Embedded 9005 Series Processors | EmbeddedTurinPI_SP5_1004 | 2026-04-13
Revision Date | Description: 2026-11-10 | Initial version
The Secure Debug Unlock bypass. The summary, score and three firmware rows from AMD-SB-3049. Debug unlock depends on a key provisioned in the BIOS, so the BIOS version is the control.
AMD-SB-3049, summary: An improper signature validation vulnerability in the Secure Debug Unlock (SDU) authorization mechanism was identified internally.
CVE-2025-0008 | 8.4 | CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
AMD EPYC™ 7003 Series Processors | CVE-2025-0008 | MilanPI 1.0.0.G | 2025-01-29
AMD EPYC™ 7002 Series Processors | CVE-2025-0008 | RomePI-SP3_1.0.0.Q | 2026-04-27
AMD EPYC™ Embedded 3000 Series Processors | CVE-2025-0008 | SnowyOwl_SP4_SP4r2.1.1.0.I | 2026-06-30
IOMMU and EDK II. The two scores and weakness labels from AMD-SB-3052. The second is labelled non-AMD by AMD.
CVE-2026-14968 (non-AMD) | 7.0 | CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H | 787 - Out-of-bounds Write
CVE-2024-21954 | 7.0 | CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H | CWE-754: Improper Check for Unusual or Exceptional Conditions
Pending and not planned. The rows that are not a shipped mitigation, and the reasons AMD prints. A defender opens a tracking item per row.
AMD-SB-3061, AMD says it plans to release PI firmware to OEMs on target dates:
AMD EPYC™ Embedded 7003 Series Processors | CVE-2026-40671 | Version TBD | Target release planned for Jan'27
AMD EPYC™ Embedded 9005 Series Processors | CVE-2026-40671 | Version TBD | Target release planned for Feb'27
AMD EPYC™ Embedded 8004 Series Processors | CVE-2026-40671 | Version TBD | Target release planned for Apr'27
AMD EPYC™ Embedded 9004 Series Processors | CVE-2026-40671 | Version TBD | Target release planned for Apr'27
AMD-SB-6028:
AMD Instinct™ MI350 | CVE-2026-0002 | BKC 26.02 | Target release planned for Nov'26
CVE-2026-0457 | No fix planned1 | N/A
1Restricting register access will break profilers.
AMD-SB-7067:
AMD Ryzen™ 3000 Series Desktop Processors | CVE-2026-28235 | No fix planned1 | N/A
1This issue is not being fixed because recent architectural changes in the RAID driver and installer make the updated stack incompatible with older programs and therefore updates cannot be applied to these systems.
A formatting fault in AMD's scores. Three vector strings in SB-6028 are printed with a colon after 4.0. A tool that ingests these should normalise them, or read the score from the number beside them.
AMD-SB-6028, CVSS strings as printed for three CVEs (a colon follows 4.0 where a slash is expected):
CVE-2024-36313 | 8.9 | CVSS:4.0:AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVE-2025-0047 | 8.8 | CVSS:4.0:AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVE-2024-36317 | 6.2 | CVSS:4.0:AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H
AMD's listing rows. Five rows from the listing, copied as printed with the title column left out because titles contain characters this site does not reproduce. The briefs print N/A where a bulletin prints a CVE.
AMD ID | Type | CVEs | Published Date | Last Updated Date
AMD-SB-3050 | Security Bulletin | CVE-2025-61963 | Nov 10, 2026 | Nov 10, 2026
AMD-SB-3049 | Security Bulletin | CVE-2025-0008 | Nov 10, 2026 | Nov 10, 2026
AMD-SB-3052 | Security Bulletin | CVE-2024-21954, CVE-2026-14968 (non-AMD) | Nov 10, 2026 | Nov 10, 2026
AMD-SB-9031 | Security Bulletin | CVE-2026-70519, CVE-2026-70518 | Nov 09, 2026 | Nov 09, 2026
AMD-SB-7076 | Security Brief | N/A | Nov 10, 2026 | Nov 10, 2026
CISA's catalogue header and Intel's robots.txt answer. The first fixes the catalogue version the KEV statements rest on; the second is the answer that stopped this site reading Intel's pages.
"title": "CISA Catalog of Known Exploited Vulnerabilities",
"catalogVersion": "2026.11.10",
"dateReleased": "2026-11-10T19:03:29.8375Z",
"count": 1779
hxxps://www[.]intel[.]com/robots.txt, as answered to this client:
<HTML><HEAD>
<TITLE>Access Denied</TITLE>
</HEAD><BODY>
<H1>Access Denied</H1>
You don't have permission to access "http://www.intel.com/robots.txt" on this server.
The question the advisories leave open
AMD's pages give three dates for a flaw, the day a mitigation was released to its board partners, the day the advisory appeared, and the day, sometimes months away, that a target says it will ship. None of them is the day a given server was patched. If your asset register records the advisory date as the fix date, which of these 100 CVEs is open on your estate today, and who would know?
Key facts
Sources
- PrimaryAMD Product Security: the listing of bulletins and briefs with IDs, CVEs and dates, the definitions of bulletin and brief, and the mitigation timing policy. Read in fullAMDaccessed 2026-11-11
- PrimaryAMD-SB-3050, AMD UEFI Vulnerability, CVE-2025-61963: score 8.4, SMM code execution, platform firmware release dates. Read in fullAMDaccessed 2026-11-11
- PrimaryAMD-SB-3049, Secure Debug Unlock vulnerability, CVE-2025-0008: score 8.4, mitigation dates. Read in fullAMDaccessed 2026-11-11
- PrimaryAMD-SB-3052, IOMMU and SMM out-of-bounds write: CVE-2024-21954 and CVE-2026-14968, both 7.0. Read in fullAMDaccessed 2026-11-11
- PrimaryAMD-SB-6028, AMD Graphics Vulnerabilities, November 2026: 44 CVEs for Radeon and Instinct, scores, dates, targets and No fix planned. Read in fullAMDaccessed 2026-11-11
- PrimaryAMD-SB-3061, SEV incomplete cleanup, CVE-2026-40671: microcode dates and BIOS target months to April 2027. Read in fullAMDaccessed 2026-11-11
- PrimaryAMD-SB-3059, SEV vulnerability, CVE-2026-0462: BIOS targets December 2026 and February 2027. Read in fullAMDaccessed 2026-11-11
- PrimaryAMD-SB-7067, RAIDXpert2, CVE-2026-28235: No fix planned for 14 product rows and AMD's stated reason. Read in fullAMDaccessed 2026-11-11
- PrimaryAMD-SB-4028, Ryzen integrated graphics, 26 CVEs: targets and No fix planned for Ryzen Z1 and Z2. Read in fullAMDaccessed 2026-11-11
- PrimaryAMD-SB-3064, a security brief on RowHammer and SEV-SNP: keep ECC enabled. Read in fullAMDaccessed 2026-11-11
- PrimaryAMD-SB-7076, a security brief on a cross-core covert channel: existing mitigation guidance applies. Read in fullAMDaccessed 2026-11-11
- PrimaryCVE-2026-61887 record: MigTD SPDM rebind, CWE-304, CVSS 4.0 9.4 Critical, version See references, dates. Read in fullCVE Program, Intel as assigneraccessed 2026-11-11
- PrimaryNVD record for CVE-2026-61887: status Received, Intel's score typed Secondary, published 2026-11-10T18:17:44.703. Read in fullNIST NVDaccessed 2026-11-11
- PrimaryCVE-2025-0008 record: CVSS 4.0 8.4 matching AMD-SB-3049, published 2026-11-10T22:16:00.457Z. Read in fullCVE Program, AMD as assigneraccessed 2026-11-11
- PrimaryKnown Exploited Vulnerabilities catalogue JSON, version 2026.11.10, released 19:03 UTC on 10 November 2026: checked for the 100 AMD identifiers and CVE-2026-61887CISAaccessed 2026-11-11
- Reported byChipmaker Patch Tuesday: Over 200 Vulnerabilities Addressed by Intel, AMD, 11 November 2026 3:42 AM ET: the counts and Intel and AMD statements this briefing tests. Secondary; read in fullSecurityWeekaccessed 2026-11-11
