VulnSocial

CVE-2026-92701Disclosure

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Cocos AI is a confidential computing system for AI. In Cocos AI 0.8.2 and earlier, VerifTeeAttestation in the Intel TDX aTLS verifier receives an expected current-session value but does not apply it to TdQuoteBodyPolicy.ReportData before validating TDX QuoteV4 evidence. The verifier can consequently accept structurally valid evidence containing mismatched or reused REPORT_DATA for the current TLS session, causing the relying party to release application data or make a trust or authorization decision for an unrelated attestation context. This issue was fixed in Cocos AI 0.9.0 by removing the affected verifier path as part of the migration to post-handshake attestation.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-346CWE-354

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-22); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-22: 1Mentions · 2026-09-30: 1Patch / Workaround · 2026-09-30: 1Technical Details · 2026-09-30: 109-2209-30
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-09-221
Disclosure1
2026-09-301
Patch1
Full discourse2 posts
  • Muhammad Usama Sardar@M_UsamaSardar
    Patch

    3 critical-severity vulnerabilities discovered in early attestation: - Ultraviolet Cocos AI resulting in CVE-2026-92701 and CVE-2026-92702 of CVSS 9.1 each - Edgeless Systems Contrast in policies resulting in GHSA of CVSS 9.0-10 https://www.researchgate.net/publication/414529199_EarlyAttestationBleed_Three_Critical-severity_Vulnerabilities_of_CVSS_90_in_Confidential_Computing https://github.com/edgelesssys/contrast/security/advisories/GHSA-m2qg-wrxv-h898

    Post summary

    The post discloses three critical-severity vulnerabilities in early attestation with high CVSS scores and references a GitHub security advisory for remediation.

    0002062
    19 followersView on X
  • Cybersecurity News DE@cybsecuritynews
    Disclosure

    #schwachstellen CVE-2026-92701: Kritische Schwachstelle in Trusted Execution Environments bis Version 0.8.2 #atls #cve202692701 #inteltdx #trustedexecutionenvironments https://cybersecurity-news.de/cve-2026-92701-trusted-execution-environments-0-8-2

    Post summary

    The tweet announces CVE-2026-92701, a critical vulnerability in Trusted Execution Environments affecting versions up to 0.8.2, and includes a link to a news article for further information.

    0000030
    13 followersView on X

Explore more

Back to dashboard