CVE-2026-20728: Intel Extension for TensorFlow:

CISO Take

Intel disclosed a protection mechanism failure (CWE-693) in Intel Extension for TensorFlow before version 2.15.0.3 that can let an adversary escalate privileges from a Ring 3 user application context, provided they already hold a privileged local account and can induce passive user interaction. This is not remotely or network exploitable and is not in CISA KEV; CISA's own SSVC decision is TRACK (lowest urgency tier), EPSS sits at 0.0012 (negligible near-term exploitation probability), and no public PoC or Nuclei template exists. The realistic threat model is a malicious or compromised insider on a shared ML training/inference host — for example a multi-tenant GPU/CPU cluster running Intel oneAPI-accelerated TensorFlow workloads — using the flaw to break out of application-level isolation. Security teams running Intel Extension for TensorFlow on shared or multi-tenant compute should patch to 2.15.0.3 or later during the next routine maintenance window; this does not warrant emergency out-of-band patching given the local-access and privileged-user prerequisites. No detection signature is published by Intel, so until patched, monitor for anomalous privilege transitions or unexpected process ancestry on hosts running this extension.

Sources:NVDEPSSCISA KEVintel.com

What is the risk?

Overall risk is LOW despite the high theoretical CIA impact (confidentiality/integrity/availability all rated high in Intel's own scoring). The attacker preconditions are restrictive: local access only, attacker must already be a privileged user on the host, and passive user interaction is required to trigger the flaw. Combined with an EPSS score of 0.0012, no CISA KEV listing, no public exploit code, no Nuclei template, and a CISA SSVC decision of TRACK, this is a patch-on-normal-cadence issue rather than an urgent one. Risk rises meaningfully only in shared/multi-tenant ML compute environments where multiple parties with elevated local access coexist on the same host.

How does the attack unfold?

Initial Access

Adversary already holds a privileged local account on a host running Intel Extension for TensorFlow before version 2.15.0.3, typically a shared ML training or inference server.

Local Exploitation

Attacker triggers the CWE-693 protection mechanism failure via a low-complexity local action, requiring passive interaction from another user or process on the same system.

Privilege Escalation

The flaw allows escalation beyond the Ring 3 user application boundary, granting the attacker elevated access on the host.

Impact

Elevated access can expose or compromise other tenants' training data, model artifacts, or credentials co-resident on the shared ML compute host (confidentiality, integrity, and availability impact all rated high).

AML.T0037

Initial Access

Adversary already holds a privileged local account on a host running Intel Extension for TensorFlow before version 2.15.0.3, typically a shared ML training or inference server.

Local Exploitation

Attacker triggers the CWE-693 protection mechanism failure via a low-complexity local action, requiring passive interaction from another user or process on the same system.

Privilege Escalation

The flaw allows escalation beyond the Ring 3 user application boundary, granting the attacker elevated access on the host.

Impact

Elevated access can expose or compromise other tenants' training data, model artifacts, or credentials co-resident on the shared ML compute host (confidentiality, integrity, and availability impact all rated high).

AML.T0037

How severe is it?

CVSS 3.1

N/A

EPSS

0.1%

chance of exploitation in 30 days

Higher than 2% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

1) Patch Intel Extension for TensorFlow to version 2.15.0.3 or later per Intel's advisory (intel-sa-01458). 2) On shared/multi-tenant ML training or inference hosts, treat this as priority given the elevated-privilege blast radius even though remote exploitation is not possible. 3) Enforce least-privilege on local accounts that run TensorFlow/Intel Extension workloads — avoid granting unnecessary privileged access to users who only need to run training/inference jobs. 4) Until patched, monitor for unexpected privilege escalation events, anomalous process ancestry, or unusual local account behavior on affected hosts. 5) No compensating network control exists since this is a local vulnerability — inventory which hosts run this package (via pip show intel-extension-for-tensorflow or package manifests) to scope the patch rollout.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionAuth BypassFrameworkTraining Data

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.3-AI system security

NIST AI RMF

MEASURE 2.7-AI system security and resilience is evaluated

Frequently Asked Questions

What is CVE-2026-20728?

Intel disclosed a protection mechanism failure (CWE-693) in Intel Extension for TensorFlow before version 2.15.0.3 that can let an adversary escalate privileges from a Ring 3 user application context, provided they already hold a privileged local account and can induce passive user interaction. This is not remotely or network exploitable and is not in CISA KEV; CISA's own SSVC decision is TRACK (lowest urgency tier), EPSS sits at 0.0012 (negligible near-term exploitation probability), and no public PoC or Nuclei template exists. The realistic threat model is a malicious or compromised insider on a shared ML training/inference host — for example a multi-tenant GPU/CPU cluster running Intel oneAPI-accelerated TensorFlow workloads — using the flaw to break out of application-level isolation. Security teams running Intel Extension for TensorFlow on shared or multi-tenant compute should patch to 2.15.0.3 or later during the next routine maintenance window; this does not warrant emergency out-of-band patching given the local-access and privileged-user prerequisites. No detection signature is published by Intel, so until patched, monitor for anomalous privilege transitions or unexpected process ancestry on hosts running this extension.

Is CVE-2026-20728 actively exploited?

No confirmed active exploitation of CVE-2026-20728 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-20728?

1) Patch Intel Extension for TensorFlow to version 2.15.0.3 or later per Intel's advisory (intel-sa-01458). 2) On shared/multi-tenant ML training or inference hosts, treat this as priority given the elevated-privilege blast radius even though remote exploitation is not possible. 3) Enforce least-privilege on local accounts that run TensorFlow/Intel Extension workloads — avoid granting unnecessary privileged access to users who only need to run training/inference jobs. 4) Until patched, monitor for unexpected privilege escalation events, anomalous process ancestry, or unusual local account behavior on affected hosts. 5) No compensating network control exists since this is a local vulnerability — inventory which hosts run this package (via `pip show intel-extension-for-tensorflow` or package manifests) to scope the patch rollout.

What systems are affected by CVE-2026-20728?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, model serving.

What is the CVSS score for CVE-2026-20728?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

training pipelinesmodel serving

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.3

NIST AI RMF: MEASURE 2.7

What are the technical details?

Original Advisory

Protection mechanism failure for some Intel Extension for TensorFlow software before version 2.15.0.3 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Exploitation Scenario

A data scientist or contractor with legitimate but limited privileged access to a shared multi-tenant ML training cluster running Intel Extension for TensorFlow triggers the protection mechanism failure through a low-complexity local action that requires some passive interaction from another user or process on the same host (e.g., another job running or a file being accessed). This allows the attacker to escalate beyond their intended privilege boundary within the Ring 3 application context, potentially gaining access to other tenants' training data, model artifacts, or credentials stored on the shared host — turning a single insider or compromised low-trust account into a broader host-level threat.

Weaknesses (CWE)

CWE-693Protection Mechanism FailurePrimary CWE-693Protection Mechanism Failure

CWE-693 — Protection Mechanism Failure: The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Source: MITRE CWE corpus.