{"id":"CVE-2021-26387","url":"https://www.cyber-defence.io/tools/cve/CVE-2021-26387","generatedAt":"2026-10-27T22:28:41.431Z","title":"Insufficient access controls in ASP kernel may allow a privileged attacker with access to AMD signing keys and the BIOS menu or UEFI shell to map DRAM regions in protected areas, potentially leading to a loss of platform integrity.","description":"Insufficient access controls in ASP kernel may allow a\nprivileged attacker with access to AMD signing keys and the BIOS menu or UEFI\nshell to map DRAM regions in protected areas, potentially leading to a loss of platform integrity.","published":"2024-08-13T17:15:18.000Z","lastModified":"2026-06-17T03:43:18.000Z","status":"Deferred","sourceIdentifier":"psirt@amd.com","cvss":{"version":"3.1","score":3.9,"severity":"LOW","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L"},"cwe":["CWE-863"],"affected":[],"epss":{"score":0.00146,"percentile":0.03771,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.15%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3003.html","source":"psirt@amd.com"},{"url":"https://www.amd.com/en/resources/product-security/bulletin/amd-sb-5002.html","source":"psirt@amd.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-26387","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}