TI-2026-60397 Aliases CVE-2026-89172 GHSA-pxq3-m9x7-5w4m

Side-channel attack of AN1044/AN953/SW300052 cryptographic algorithms

LOW 25CWE-1300Published 2026-09-12 · Updated 2026-09-14

Key facts

Attack vector: Physical
Privileges required: None
User interaction: None
Attack complexity: High
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Improper protection of physical side channels vulnerability in Microchip AN1044, Microchip AN953, and Microchip SW300052. This issue affects AN1044: through A; AN953: through A; SW300052: through 2.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.002 9th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microchip	AN1044	up to A	—	No fix listed	CNA
Microchip	AN953	up to A	—	No fix listed	CNA
Microchip	SW300052	up to 2.6	—	No fix listed	CNA

AN1044 VendorMicrochip Affected up to A Fixed in — No fix listed CNA
AN953 VendorMicrochip Affected up to A Fixed in — No fix listed CNA
SW300052 VendorMicrochip Affected up to 2.6 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-89172
2026-10-03 Alias added: GHSA-pxq3-m9x7-5w4m

References

Advisory 1

https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/side-channel-attack-an1044-an953-sw300052-cryptographic-algorithms

Other 3

TI-2022-18950 Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability. CVSS 3.1CRITICAL 9.8
TI-2023-28092 Improper input validation in Siemens SIMATIC IPC1047E CVSS 3.1CRITICAL 10.0
TI-2024-19958 Microchip Harmony 3 Core library allows read and write access to RAM via a SCSI READ or WRITE command CVSS 4.0HIGH 7.0
TI-2024-08405 Remote code Execution inTimeProvider® 4100 CVSS 4.0HIGH 8.5
TI-2009-01524 Multiple buffer overflows in Microchip MPLAB IDE 8.30 and possibly earlier versions allow… CVSS 2.0HIGH 9.3
TI-2020-13207 An issue was discovered in picoTCP 1.7.0. CVSS 3.1CRITICAL 9.1

See all 59 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences