CVE-2022-26837 [High] | Input Validation Bypass in Xeon Gold 5317 Firmware

CVE-2022-26837 is rated Low Risk (36.1/100): CVSS High severity, with low exploitation likelihood (EPSS 0.06%). Monitor for updates and reassess as exploit intelligence or EPSS changes.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-03-18	0.04%	0.06%	+0.01%
2	2023-03-07	0.89%	0.04%	-0.84%
3	2023-02-17	—	0.89%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-03-18

0.04%

0.06%

+0.01%

2023-03-07

0.89%

0.04%

-0.84%

2023-02-17

—

0.89%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
7.5	3.1	HIGH	`CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H` Click to expand Attack vector (AV:L) They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:H) They need powerful rights—admin, root, or similar—before this pays off. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:C) Breaking this can reach past the original component and bite other resources—bigger blast radius. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	0.8	6.0	[email protected]
7.0	3.1	HIGH	`CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H` Click to expand Attack vector (AV:L) They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	1.0	5.9	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

7.5

3.1

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Click to expand

Attack vector (AV:L): They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:H): Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:H): They need powerful rights—admin, root, or similar—before this pays off.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:C): Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

0.8

6.0

[email protected]

7.0

3.1

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Click to expand

Attack vector (AV:L): They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:H): Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

1.0

5.9

[email protected]

OS Trackers for CVE-2022-26837

vendor	priority	summary	link
`redhat`	high	—	https://access.redhat.com/security/cve/CVE-2022-26837

vendor

priority

summary

link

redhat

high

—

https://access.redhat.com/security/cve/CVE-2022-26837

Affected software / configurations for CVE-2022-26837

Vendor	Product	Version	Raw CPE
intel	xeon_gold_5317_firmware	—	cpe:2.3:o:intel:xeon_gold_5317_firmware:-:::::::*
intel	xeon_gold_5318n_firmware	—	cpe:2.3:o:intel:xeon_gold_5318n_firmware:-:::::::*
intel	xeon_gold_5318s_firmware	—	cpe:2.3:o:intel:xeon_gold_5318s_firmware:-:::::::*
intel	xeon_gold_5318y_firmware	—	cpe:2.3:o:intel:xeon_gold_5318y_firmware:-:::::::*
intel	xeon_gold_5320_firmware	—	cpe:2.3:o:intel:xeon_gold_5320_firmware:-:::::::*
intel	xeon_gold_5320t_firmware	—	cpe:2.3:o:intel:xeon_gold_5320t_firmware:-:::::::*
intel	xeon_gold_6312u_firmware	—	cpe:2.3:o:intel:xeon_gold_6312u_firmware:-:::::::*
intel	xeon_gold_6314u_firmware	—	cpe:2.3:o:intel:xeon_gold_6314u_firmware:-:::::::*
intel	xeon_gold_6326_firmware	—	cpe:2.3:o:intel:xeon_gold_6326_firmware:-:::::::*
intel	xeon_gold_6330_firmware	—	cpe:2.3:o:intel:xeon_gold_6330_firmware:-:::::::*
intel	xeon_gold_6330n_firmware	—	cpe:2.3:o:intel:xeon_gold_6330n_firmware:-:::::::*
intel	xeon_gold_6334_firmware	—	cpe:2.3:o:intel:xeon_gold_6334_firmware:-:::::::*
intel	xeon_gold_6336y_firmware	—	cpe:2.3:o:intel:xeon_gold_6336y_firmware:-:::::::*
intel	xeon_gold_6338_firmware	—	cpe:2.3:o:intel:xeon_gold_6338_firmware:-:::::::*
intel	xeon_gold_6338n_firmware	—	cpe:2.3:o:intel:xeon_gold_6338n_firmware:-:::::::*
intel	xeon_gold_6338t_firmware	—	cpe:2.3:o:intel:xeon_gold_6338t_firmware:-:::::::*
intel	xeon_gold_6342_firmware	—	cpe:2.3:o:intel:xeon_gold_6342_firmware:-:::::::*
intel	xeon_gold_6346_firmware	—	cpe:2.3:o:intel:xeon_gold_6346_firmware:-:::::::*
intel	xeon_gold_6348_firmware	—	cpe:2.3:o:intel:xeon_gold_6348_firmware:-:::::::*
intel	xeon_gold_6354_firmware	—	cpe:2.3:o:intel:xeon_gold_6354_firmware:-:::::::*
intel	xeon_platinum_8351n_firmware	—	cpe:2.3:o:intel:xeon_platinum_8351n_firmware:-:::::::*
intel	xeon_platinum_8352m_firmware	—	cpe:2.3:o:intel:xeon_platinum_8352m_firmware:-:::::::*
intel	xeon_platinum_8352s_firmware	—	cpe:2.3:o:intel:xeon_platinum_8352s_firmware:-:::::::*
intel	xeon_platinum_8352v_firmware	—	cpe:2.3:o:intel:xeon_platinum_8352v_firmware:-:::::::*
intel	xeon_platinum_8352y_firmware	—	cpe:2.3:o:intel:xeon_platinum_8352y_firmware:-:::::::*
intel	xeon_platinum_8358_firmware	—	cpe:2.3:o:intel:xeon_platinum_8358_firmware:-:::::::*
intel	xeon_platinum_8358p_firmware	—	cpe:2.3:o:intel:xeon_platinum_8358p_firmware:-:::::::*
intel	xeon_platinum_8360y_firmware	—	cpe:2.3:o:intel:xeon_platinum_8360y_firmware:-:::::::*
intel	xeon_platinum_8362_firmware	—	cpe:2.3:o:intel:xeon_platinum_8362_firmware:-:::::::*
intel	xeon_platinum_8368_firmware	—	cpe:2.3:o:intel:xeon_platinum_8368_firmware:-:::::::*
intel	xeon_platinum_8368q_firmware	—	cpe:2.3:o:intel:xeon_platinum_8368q_firmware:-:::::::*
intel	xeon_platinum_8380_firmware	—	cpe:2.3:o:intel:xeon_platinum_8380_firmware:-:::::::*
intel	xeon_silver_4309y_firmware	—	cpe:2.3:o:intel:xeon_silver_4309y_firmware:-:::::::*
intel	xeon_silver_4310_firmware	—	cpe:2.3:o:intel:xeon_silver_4310_firmware:-:::::::*
intel	xeon_silver_4310t_firmware	—	cpe:2.3:o:intel:xeon_silver_4310t_firmware:-:::::::*
intel	xeon_silver_4314_firmware	—	cpe:2.3:o:intel:xeon_silver_4314_firmware:-:::::::*
intel	xeon_silver_4316_firmware	—	cpe:2.3:o:intel:xeon_silver_4316_firmware:-:::::::*
intel	xeon_gold_6330h_firmware	—	cpe:2.3:o:intel:xeon_gold_6330h_firmware:-:::::::*
intel	xeon_platinum_8356h_firmware	—	cpe:2.3:o:intel:xeon_platinum_8356h_firmware:-:::::::*
intel	xeon_platinum_8360h_firmware	—	cpe:2.3:o:intel:xeon_platinum_8360h_firmware:-:::::::*
intel	xeon_platinum_8360hl_firmware	—	cpe:2.3:o:intel:xeon_platinum_8360hl_firmware:-:::::::*
intel	xeon_gold_5318h_firmware	—	cpe:2.3:o:intel:xeon_gold_5318h_firmware:-:::::::*
intel	xeon_gold_5320h_firmware	—	cpe:2.3:o:intel:xeon_gold_5320h_firmware:-:::::::*
intel	xeon_gold_6328h_firmware	—	cpe:2.3:o:intel:xeon_gold_6328h_firmware:-:::::::*
intel	xeon_gold_6328hl_firmware	—	cpe:2.3:o:intel:xeon_gold_6328hl_firmware:-:::::::*
intel	xeon_gold_6348h_firmware	—	cpe:2.3:o:intel:xeon_gold_6348h_firmware:-:::::::*
intel	xeon_platinum_8353h_firmware	—	cpe:2.3:o:intel:xeon_platinum_8353h_firmware:-:::::::*
intel	xeon_platinum_8354h_firmware	—	cpe:2.3:o:intel:xeon_platinum_8354h_firmware:-:::::::*
intel	xeon_platinum_8376h_firmware	—	cpe:2.3:o:intel:xeon_platinum_8376h_firmware:-:::::::*
intel	xeon_platinum_8376hl_firmware	—	cpe:2.3:o:intel:xeon_platinum_8376hl_firmware:-:::::::*
intel	xeon_platinum_8380h_firmware	—	cpe:2.3:o:intel:xeon_platinum_8380h_firmware:-:::::::*
intel	xeon_platinum_8380hl_firmware	—	cpe:2.3:o:intel:xeon_platinum_8380hl_firmware:-:::::::*
intel	xeon_e-2314_firmware	—	cpe:2.3:o:intel:xeon_e-2314_firmware:-:::::::*
intel	xeon_e-2324g_firmware	—	cpe:2.3:o:intel:xeon_e-2324g_firmware:-:::::::*
intel	xeon_e-2334_firmware	—	cpe:2.3:o:intel:xeon_e-2334_firmware:-:::::::*
intel	xeon_e-2336_firmware	—	cpe:2.3:o:intel:xeon_e-2336_firmware:-:::::::*
intel	xeon_e-2356g_firmware	—	cpe:2.3:o:intel:xeon_e-2356g_firmware:-:::::::*
intel	xeon_e-2374g_firmware	—	cpe:2.3:o:intel:xeon_e-2374g_firmware:-:::::::*
intel	xeon_e-2378_firmware	—	cpe:2.3:o:intel:xeon_e-2378_firmware:-:::::::*
intel	xeon_e-2378g_firmware	—	cpe:2.3:o:intel:xeon_e-2378g_firmware:-:::::::*
intel	xeon_e-2386g_firmware	—	cpe:2.3:o:intel:xeon_e-2386g_firmware:-:::::::*
intel	xeon_e-2388g_firmware	—	cpe:2.3:o:intel:xeon_e-2388g_firmware:-:::::::*
intel	xeon_e-2226ge_firmware	—	cpe:2.3:o:intel:xeon_e-2226ge_firmware:-:::::::*
intel	xeon_e-2254me_firmware	—	cpe:2.3:o:intel:xeon_e-2254me_firmware:-:::::::*
intel	xeon_e-2254ml_firmware	—	cpe:2.3:o:intel:xeon_e-2254ml_firmware:-:::::::*
intel	xeon_e-2276me_firmware	—	cpe:2.3:o:intel:xeon_e-2276me_firmware:-:::::::*
intel	xeon_e-2276ml_firmware	—	cpe:2.3:o:intel:xeon_e-2276ml_firmware:-:::::::*
intel	xeon_e-2278ge_firmware	—	cpe:2.3:o:intel:xeon_e-2278ge_firmware:-:::::::*
intel	xeon_e-2278gel_firmware	—	cpe:2.3:o:intel:xeon_e-2278gel_firmware:-:::::::*
intel	xeon_e-2224_firmware	—	cpe:2.3:o:intel:xeon_e-2224_firmware:-:::::::*
intel	xeon_e-2224g_firmware	—	cpe:2.3:o:intel:xeon_e-2224g_firmware:-:::::::*
intel	xeon_e-2226g_firmware	—	cpe:2.3:o:intel:xeon_e-2226g_firmware:-:::::::*
intel	xeon_e-2234_firmware	—	cpe:2.3:o:intel:xeon_e-2234_firmware:-:::::::*
intel	xeon_e-2236_firmware	—	cpe:2.3:o:intel:xeon_e-2236_firmware:-:::::::*
intel	xeon_e-2244g_firmware	—	cpe:2.3:o:intel:xeon_e-2244g_firmware:-:::::::*
intel	xeon_e-2246g_firmware	—	cpe:2.3:o:intel:xeon_e-2246g_firmware:-:::::::*
intel	xeon_e-2274g_firmware	—	cpe:2.3:o:intel:xeon_e-2274g_firmware:-:::::::*
intel	xeon_e-2276g_firmware	—	cpe:2.3:o:intel:xeon_e-2276g_firmware:-:::::::*
intel	xeon_e-2276m_firmware	—	cpe:2.3:o:intel:xeon_e-2276m_firmware:-:::::::*
intel	xeon_e-2278g_firmware	—	cpe:2.3:o:intel:xeon_e-2278g_firmware:-:::::::*

References for CVE-2022-26837

URL	Tags
http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00717.html	Vendor Advisory

URL

CVE-2022-26837

Exploit prediction scoring system (EPSS) score for CVE-2022-26837

Common vulnerability scoring system (CVSS) metrics for CVE-2022-26837

Weakness enumeration for CVE-2022-26837

OS Trackers for CVE-2022-26837

Affected software / configurations for CVE-2022-26837

References for CVE-2022-26837