VulnSocial

CVE-2026-92702Patch

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Cocos AI is a confidential computing system for AI. In Cocos AI 0.8.2 and earlier, VerifyAttestationReportTLS in the AMD SEV-SNP verifier sets Policy.ReportData only when its caller supplies non-empty expected reportData. A relying-party integration that passes nil or empty expected reportData while relying on that value for current-session freshness can therefore accept SEV-SNP evidence unrelated to the current connection and make a trust, authorization, or application-data release decision for an unintended attestation context. This issue was fixed in Cocos AI 0.9.0 by removing the affected verifier path as part of the migration to post-handshake attestation.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-346

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 1 signal
  • Peaked 1d ago at 1 mentions (2026-09-21); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-21: 1Mentions · 2026-09-30: 1Patch / Workaround · 2026-09-21: 1Patch / Workaround · 2026-09-30: 1Technical Details · 2026-09-30: 109-2109-30
Signal classification1 categories
Patch
2100.0%
Referenced assets3 URLs
Full discourse2 posts
  • Muhammad Usama Sardar@M_UsamaSardar
    Patch

    3 critical-severity vulnerabilities discovered in early attestation: - Ultraviolet Cocos AI resulting in CVE-2026-92701 and CVE-2026-92702 of CVSS 9.1 each - Edgeless Systems Contrast in policies resulting in GHSA of CVSS 9.0-10 https://www.researchgate.net/publication/414529199_EarlyAttestationBleed_Three_Critical-severity_Vulnerabilities_of_CVSS_90_in_Confidential_Computing https://github.com/edgelesssys/contrast/security/advisories/GHSA-m2qg-wrxv-h898

    Post summary

    The post discloses three critical-severity vulnerabilities in early attestation, providing their CVSS scores, and notes a GitHub security advisory for one issue, indicating an available patch/advisory.

    0002062
    19 followersView on X
  • Cybersecurity News DE@cybsecuritynews
    Patch

    #schwachstellen CVE-2026-92702: Kritische Schwachstelle in Cocos AI bis Version 0.8.2 behoben #amdsevsnp #atls #cocosai #cve202692702 https://cybersecurity-news.de/cve-2026-92702-cocos-ai-0-8-2

    Post summary

    The tweet reports that CVE‑2026‑92702, a critical vulnerability affecting Cocos AI up to version 0.8.2, has been addressed in version 0.8.2.

    0000038
    13 followersView on X

Explore more

Back to dashboard