CVE-2026-20891

HighCVSS 7.9/10Last modified Aug 26, 2026

Description

Improper authentication for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (low) and availability (low) impacts.

Metrics

CVSS 3.1 7.9/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Aug 11, 2026
Last modified
Aug 26, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-208928.6Code injection vulnerability exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker with administrative privileges to execute arbiCVE-2026-208938.5Origin validation error issue exists in Fujitsu Security Solution AuthConductor Client Basic V2 2.0.25.0 and earlier. If this vulnerability CVE-2026-208944.8Cross-site scripting vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation. If an attacking administCVE-2026-208957.5The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the CVE-2026-208969.8Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonateCVE-2026-208979.1Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able toCVE-2026-208987.2Improper access control in the firmware for some in Alias Checking Trusted Module for some Intel(R) Xeon(R) processors may allow an escalatiCVE-2026-20909.8A vulnerability was determined in SourceCodester Online Class Record System 1.0. This issue affects some unknown processing of the file /admCVE-2026-209015.3Improper input validation for some Intel(R) Xeon(R) processors within firmware may allow an escalation of privilege. Startup code and smm adCVE-2026-209028.8An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remoteCVE-2026-209035.4Protection mechanism failure for some Intel(R) AI Containers before version v0.4.0 within Ring 3: User Applications may allow an escalation CVE-2026-209046.5Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be able to change the visibility s
CVE-2026-20891: High severity, CVSS 7.9 | Vulnix