CVE-2026-33563

MediumCVSS 4.8/10Last modified Nov 10, 2026

Description

Exposure of sensitive information to an unauthorized actor for some Intel(R) Platform Monitoring Technology (Intel(R) PMT) software before version 3.2.0.22 within Ring 3: User Applications may allow an information disclosure. System software adversary with an authenticated user combined with a low complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Metrics

CVSS 4.0 4.8/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-200

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
n/a	Intel(R) Platform Monitoring Technology (Intel(R) PMT) software	before version 3.2.0.22

References

https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01532.html

Timeline

Published: Nov 10, 2026
Last modified: Nov 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-335653.3in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.CVE-2026-335665.1There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event log data is loaded, the contents of the CVE-2026-335675.4Improper input validation for the Intel(R) VTune(TM) Profiler software within Ring 3: User Applications may allow an escalation of privilege CVE-2026-335689.1A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.CVE-2026-335696.5Anviz CX2 Lite and CX7 administrative sessions occur over HTTP, enabling on‑path attackers to sniff credentials and session data, which can CVE-2026-33578.8IBM Langflow Desktop 1.6.0 through 1.8.2 Langflow could allow an authenticated user to execute arbitrary code on the system, caused by an in CVE-2026-335705.7PowerSYSTEM Center REST API endpoint for devices allows a low privilege authenticated user to access information normally limited by operati CVE-2026-335716.9Out-of-bounds read for the Intel(R) VTune(TM) Profiler software before version 2026.0.0 within Ring 1: Device Drivers may allow a denial of CVE-2026-335725.5OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcr CVE-2026-335738.8OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in the gateway agent RPC that allows authenticated operators with o CVE-2026-335744.7OpenClaw before 2026.3.8 contains a path traversal vulnerability in the skills download installer that validates the tools root lexically bu CVE-2026-335757.5OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pair endpoint and OpenC