AMD has published two security bulletins dated November 10, 2026, AMD-SB-3059 and AMD-SB-3061, covering vulnerabilities in SEV-SNP, the confidential virtual machine (VM) protection found in its EPYC server processors and other chips. Both issues were reported by researchers at ETH Zurich and elsewhere, who have published papers describing the attacks under the names "Mior" and "Skyfall." Each assumes an attacker who controls the host side, such as a cloud provider's hypervisor.
Both Flaws Assume an Attacker Who Controls the Host
SEV-SNP encrypts a virtual machine's memory so that the host cannot read or alter what is inside. It serves as a foundation for confidential computing, which lets organizations handle sensitive data in the cloud. The two newly disclosed issues could undermine that isolation from the host.
| Item | Mior | Skyfall |
|---|---|---|
| AMD security bulletin | AMD-SB-3059 | AMD-SB-3061 |
| CVE | CVE-2026-0462 | CVE-2026-40671 |
| CVSS 4.0 base score | 5.9 | 4.9 |
| Main impact | Integrity of guest memory | Disclosure of guest register state |
| Paper venue | ACM CCS '26 | IEEE S&P 2027 |
AMD says CVE-2026-0462 means "a malicious hypervisor may manipulate Memory Mapped I/O (MMIO) routing," potentially compromising SEV-SNP integrity. Only SEV-SNP is affected; SEV and SEV-ES are not. CVE-2026-40671 stems from incomplete cleanup during VMRUN error handling, which could allow access to an SEV-SNP guest's register state and lead to information disclosure.
Mior Redirects Memory Routing to Devices Such as GPUs
Mior was discovered by Chris Wech, Philipp Giersfeld, Benedict Schlüter, and Shweta Shinde of ETH Zurich. The researchers describe it as "a software-only attack that compromises SEV-SNP by yet again corrupting the routing on the Infinity Fabric," the processor's internal interconnect. The attacker must control the BIOS and the hypervisor and be able to use a PCIe device, such as a GPU, to back the redirected memory accesses.
The team demonstrated an end-to-end attack on a Zen 5 EPYC 9135. Based on source code analysis, they say Zen 3 and Zen 4 are potentially affected. The researchers reported the issue to AMD on February 12, 2026, and the embargo ended on November 10.
Skyfall Builds on the Known TSA Technique to Read Data
Skyfall was discovered by Benedict Schlüter, Alessandro Vezzù, and Shweta Shinde of ETH Zurich, together with Daniel Moghimi of Google. It is a microarchitectural data sampling attack on AMD processors that builds on the previously known Transient Scheduler Attacks (TSA) technique. Beyond confidential VMs, the researchers say it also targets microcode and System Management Mode (SMM) memory.
The confidential VM attack requires a malicious host or hypervisor, but no physical modification of the hardware. The team ran its experiments on a Zen 3 EPYC 7313 and on Zen 4 EPYC 9124 and 9334 processors. For the SMM-related issue, EDK II, an implementation of UEFI, assigned CVE-2026-18448.
Fixes Will Arrive as BIOS Updates From Server Makers
AMD has prepared mitigations for its EPYC 7003, 8004, 8005, 9004, and 9005 series. For Mior, it plans to deliver Platform Initialization (PI) firmware containing SEV firmware dated August 12, 2026, to server makers in December. For Skyfall, it plans to deliver PI firmware containing microcode dated August 12 in November. A Skyfall fix for AMD Instinct MI300A was released on September 21. Mitigations for embedded EPYC processors are scheduled between January and April 2027.
AMD advises customers to contact their server maker (OEM) for BIOS updates specific to their products. Neither bulletin says whether the flaws have been exploited in actual attacks.
Companies running SEV-SNP confidential VMs in the cloud should check for updates from their cloud provider. Organizations operating their own EPYC servers will need to confirm when their server maker will ship the BIOS updates and plan to apply them.
Our Take
Both attacks require the attacker to hold powerful privileges on the host, and their CVSS scores are moderate. They are unlikely to cause immediate harm to ordinary users. Still, SEV-SNP was designed so that customers would not have to trust even the cloud provider, and the fact that research undermining that premise keeps coming from the same group carries weight. Because the fixes reach systems as BIOS updates through server makers, it will likely take time before they are widely deployed.
Summary
AMD has disclosed CVE-2026-0462 and CVE-2026-40671, two SEV-SNP vulnerabilities, in bulletins dated November 10. They correspond to the Mior and Skyfall attacks found by researchers at ETH Zurich and elsewhere, and EPYC firmware fixes are scheduled to reach server makers between November and December. Companies that rely on confidential VMs should watch for guidance from their cloud providers and server makers.
