Priority LOW 31
Incorrect check of function return value in Caliptra Core Runtime Firmware (ActivateFirmwareCmd::activate_fw modules) allows bypass of Caliptra Core's verification of the MCU FW during a hitless update.
Caliptra
Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
Caliptra records in CISA KEVNo Caliptra vulnerabilities are listed in CISA KEV.
Records
5 records
TI-2026-06435 CVE-2026-7328
Unverified AXI Address in Subsystem Mode Commands Enables Denial of Service
Priority LOW 29
Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD commands) in subsystem mode allows a privileged local attacker to cause a denial of service via ma…
TI-2026-10213 CVE-2026-11835
Caliptra Update-Reset Secure-Boot Bypass via Attacker-Chosen AXI Staging Address (TOCTOU)
Priority LOW 24
Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in Caliptra Core ROM (UpdateResetFlow::run()) in subsystem mode allows a compromised local attacker to silently bypass secure boot b…
TI-2026-05666 CVE-2026-6458
AES-256-GCM Authentication Tag Does Not Cover First Ciphertext Blocks When AAD Is Empty
Priority LOW 23
Missing cryptographic step in Caliptra Core Firmware (aes_256_gcm_update module) results in an incorrect GCM authentication tag.
Priority LOW 9
Insufficient verification of data authenticity in Caliptra Core ROM and Core Firmware (validate_debug_unlock_token()) in subsystem mode allows an attacker with access to the integrator's debug unlock signing service to u…