AI Threat Alert
CVE-2026-6484
HIGHIn an UEFI, Lack of verified boot to certain FV may cause arbitrary code...
Full CISO analysis pending enrichment.
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| H2O | pip | — | No patch |
Do you use H2O? You're affected.
How severe is it?
What is the attack surface?
What should I do?
No patch available
Monitor for updates. Consider compensating controls or temporary mitigations.
Which compliance frameworks are affected?
Compliance analysis pending. Sign in for full compliance mapping when available.
Frequently Asked Questions
What is CVE-2026-6484?
In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution.
Is CVE-2026-6484 actively exploited?
No confirmed active exploitation of CVE-2026-6484 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-6484?
No patch is currently available. Monitor vendor advisories for updates.
What is the CVSS score for CVE-2026-6484?
CVE-2026-6484 has a CVSS v3.1 base score of 8.2 (HIGH).
What are the technical details?
Original Advisory
In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution.
Weaknesses (CWE)
CWE-1277 — Firmware Not Updateable: The product does not provide its users with the ability to update or patch its firmware to address any vulnerabilities or weaknesses that may be present.
- [Requirements] Specify requirements to include the ability to update the firmware. Include integrity checks and authentication to ensure that untrusted firmware cannot be installed.
- [Architecture and Design] Design the device to allow for updating the firmware. Ensure that the design specifies how to distribute the updates and ensure their integrity and authentication.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H