CVE-2026-40677: High severity AMD AMD Optional Tools vulnerability
The use of insecure HTTP transport within AMD optional tools could allow an attacker to conduct a man-in-the-middle attack, potentially leading to arbitrary code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
AMD optional toolsfrom your environment.Uninstall or disable AMD optional tools that rely on insecure HTTP transport if they are not required.
- Configuration
Configure AMD optional tools to use secure transport (HTTPS/TLS) instead of insecure HTTP. Verify server certificates and disable plain HTTP endpoints or fallbacks.
AMD optional tools transport_protocol = HTTPS/TLS (disable HTTP) - Compensating control
Restrict network access to the update/management endpoints used by AMD optional tools (for example, firewall rules to allow only trusted IPs), block outbound HTTP to untrusted hosts, and apply network segmentation or isolation to reduce exposure to man-in-the-middle attacks.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40677?
CVE-2026-40677 has a high severity rating of 7.7.
How do I fix CVE-2026-40677?
To fix CVE-2026-40677, ensure that all communications with AMD optional tools are conducted over secure HTTPS instead of insecure HTTP.
What type of attack does CVE-2026-40677 allow?
CVE-2026-40677 allows for a man-in-the-middle attack that could potentially lead to arbitrary code execution.
Who is affected by CVE-2026-40677?
CVE-2026-40677 affects users of AMD optional tools that rely on insecure HTTP transport.
When was CVE-2026-40677 published?
CVE-2026-40677 was published on June 12, 2026.