Intel's 72 CVEs land in firmware, drivers and the AI tooling stack; AMD adds a dozen

Intel published 42 advisories covering 72 vulnerabilities on Tuesday, and AMD published five covering a dozen, according to SecurityWeek ^[2][9]. That is 84 issues between them ^[13], and almost none of it moves when the operating system patch cycle moves: the affected components are processor-level features, management firmware, wireless drivers, BIOS reference code, and a long tail of AI packages that engineers install themselves.

The high-severity list is where the asset inventory questions start. Intel fixed privilege escalation in Xeon processors, in the Alias Checking Trusted Module for Xeon, in TDX, and in CSME and SPS; information disclosure in Data Center Attestation Primitives; and denial of service in Active Management Technology ^[4]. PROSet/Wireless WiFi software appears twice in that list, once for privilege escalation and DoS and once for local code execution, privilege escalation and DoS ^[3][4]. Trusted execution took hits on both sides of the market: Intel patched TDX at high severity and TDX DCAP and Guest at medium ^[4][6], while AMD addressed arbitrary code execution in SEV-SNP ^[11]. AMD also disclosed a Safe RET interrupt vulnerability and a SEV attack method called PowerHooK earlier in the month, separately from Tuesday's batch ^[12].

The more interesting shift is what the medium-severity list now contains. Intel's two medium lists name Transfer Learning Tool, Extension for PyTorch, LLM-on-Ray, Gaudi Container Runtime, vLLM Hardware Plugin for Gaudi, Approximate Bayesian Inference Framework, Hardware Aware Automated Machine Learning, EquiTriton, Workload Services Framework, Performance Counter Monitor, LLM Scaler, LLM Library, oneCCL Bindings for PyTorch, AI Containers, Cluster Management Toolkit for Kubernetes, Open VKL, Extension for TensorFlow, NPU Drivers, Neural Compressor, Battery Life Diagnostic Tool, Xeon and Core Ultra, UEFI Reference BIOS, AI Reference Models, CSME and SPS ^[5][6]. At least 14 of those named products are AI, ML or accelerator-specific software rather than platform firmware ^[14]. SecurityWeek reports the medium-severity set can be exploited for privilege escalation, DoS and information disclosure, without mapping each impact to each product ^[7]. A low-severity fix landed in Slim Bootloader ^[8].

AMD's largest single advisory covers five high-severity issues in the Vitis development environment, with impacts described as private key disclosure, privilege escalation and arbitrary code execution ^[10]. Arbitrary code execution was also fixed in Ryzen Master Utility and Power Design Manager ^[11].

For scale, SecurityWeek's August 2026 Microsoft tally was 421 CVEs and one exploited zero-day ^[17]. Nothing in the chipmaker coverage reports any of these 84 as exploited in the wild ^[18], which is exactly why they get deferred. An earlier chipmaker round covered 70 vulnerabilities across the two vendors ^[16], so 84 is a normal-sized quarter, not an emergency, spread across 47 advisories that mostly do not map to a single deployment channel ^[15].

Three things to watch. Whether the Xeon, CSME/SPS, UEFI Reference BIOS and Slim Bootloader fixes ^[4][6][8] show up in OEM firmware bundles on a timeline your change window can absorb. Whether anyone in your estate can enumerate which of those AI packages ^[5][6] are running on developer workstations and shared training nodes. And whether the PROSet/Wireless local code execution path ^[4] is being tracked as an endpoint driver problem rather than a networking one.