VulnerabilityAwaiting Analysis

CVE-2026-33197

AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Incomplete List of Disallowed Inputs” by local access.

HIGH 8.7EPSS 0.12%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.12%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the “Incomplete List of Disallowed Inputs” by local access. Successful exploitation of this vulnerability may lead to arbitrary code execution and impact system Confidentiality, Integrity, and Availability.

CVSS 4.0: 8.7 HIGHCVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.12% probability · 2th percentile
CISA KEV: Not listed
Weakness: CWE-184
Source: biossecurity@ami.com

References

https://go.ami.com/hubfs/Security%20Advisories/2026/AMI-SA-2026001.pdf

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.