AMI AptioV BIOS: sensitive information exposed to an unauthorized local actor

CVSS 5.8CVE-2026-0893Firmware, BMC & network fabriccurated

Impact

The BIOS exposes sensitive information to a local actor that should not see it, which AMI states can lead to information disclosure and onward privilege escalation. On a shared GPU host the concern is firmware-held material - platform secrets, configuration or memory contents - leaking to a lower-privileged local context and shortening the path to a firmware-level compromise. Impact is rated high for confidentiality but low for integrity and availability, so this is a disclosure primitive rather than direct code execution. Tracked separately from the memory-corruption ids in the same advisory because the flaw and the remediation urgency differ.

Who can reach it

Local access with low privileges required and high attack complexity (AV:L/AC:H/PR:L, no user interaction).

What to do

Pick up the fixed BIOS build from your server OEM; AMI-SA-2026002 is the upstream advisory. The fix arrives as a BIOS flash, so each node needs to be drained, flashed out of service and rebooted. Lower severity than the code-execution ids in the same advisory, so it is reasonable to fold into the same firmware window rather than schedule its own. No fixed version is stated in the record.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-0893 https://go.ami.com/hubfs/Security%20Advisories/2026/AMI-SA-2026002.pdf

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.