CVE-2026-6484

HighCVSS 8.2/10Last modified Oct 24, 2026

Description

In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-1277

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Insyde SoftwareInsydeH2O—

References

Timeline

Published
Aug 12, 2026
Last modified
Oct 24, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-648462.8Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimenCVE-2026-648476.8AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO CVE-2026-648499.3MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and priorCVE-2026-64858.2UEFI BIOS embedded Shell could be used to bypass Secure Boot via shell commands or startup scripts.CVE-2026-648508.7Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php sends an editoCVE-2026-648518.5Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. PriCVE-2026-648528.7Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API pluginCVE-2026-648558.2soapbar is a SOAP library for Python — client, server, and WSDL handling. Prior to version 0.13.0, verify_envelope_bsp() derived its trust aCVE-2026-648563.7FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.20.0, FileRise /api/file/CVE-2026-648575.3tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user'sCVE-2026-648585.3vulnerability-operator scans SBOMs and Images for vulnerabilities. Prior to version 0.28.16, an unauthenticated information-disclosure vulneCVE-2026-648599.1New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.7, the admin user
CVE-2026-6484: High severity, CVSS 8.2 | Vulnix