CVE-2026-20702

CVE-2026-20702 targets Intel DCAP, the attestation infrastructure that validates whether confidential computing environments are genuine. The CVSS inconsistency—'confidentiality (none)' paired with 'subsequent system confidentiality (high)'—is not a scoring error but a structural signal. The vulnerability compromises the mechanism that tells you what you're protecting, not the data itself. This changes the risk calculus. An 8.9 score measures direct exploitability, but the real exposure depends on what systems depend on DCAP attestation and what those systems protect. A DCAP failure protecting public data in an air-gapped environment is fundamentally different from one protecting healthcare records or financial workloads in multi-tenant cloud infrastructure. The 'special internal knowledge' requirement gates exploitation to sophisticated adversaries, but that gating has a half-life measured in months. The knowledge gap provides latency, not protection—and it blinds defenders equally. Organizations that built attestation integrations during the 2019-2021 confidential computing push may have orphaned code paths: the architect who wired DCAP into the VM launch controller left, documentation decayed, and nobody formally owns the dependency now. Before the patch arrives, map your attestation dependency graph. Identify every system that makes security decisions based on DCAP verification—workload identity, access policies, network segmentation assumptions, secret management. Verify whether those verification calls hit patched DCAP libraries. If you have additional attestation layers (redundant verification, offline validation), confirm those layers aren't themselves calling the potentially compromised DCAP APIs. The risk is not just that exploitation is possible, but that when it occurs, the blast radius cascades through every control that assumed attestation was trustworthy.

Reviewed through automated stages and approved by a human before publication.