CVE-2026-24090

highpriority · track · 10OT risk · elevatedEPSS 0.001 · 0 %ileexploit · PoCDEEUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

0.06% (0th) EPSS

CVSS 7.1 · high

Is it mine?

223 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · osv · cert_bund

EPSS · scored 2026-10-27

Cryptographic issue while processing partition table entries allows unauthorized modification of boot flow.

cvss

Technical severity, 0–10. One row per scoring source.

7.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.7–7.1

v3.17.1highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · ENISA EU

v3.17.1highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · product-security@qualcomm.comexploitability 1.8 · impact 5.2

v3.16.7mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:Psecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-306US

exploits (1)

Public proof-of-concept and weaponised exploit code.

wnduddld0513/Lenovo_Qcom_RPMB_ToolEducational proof-of-concept (PoC) research tool demonstrating CVE-2026-24090 ABL verification bypass to inspect and test Qualcomm Keymaster RPMB state on Lenovo devices.PoC · poc_in_github

affected products (223)

Products and version ranges known to be affected.

Dell Computerall versionscert_bundDEcpe:/o:dell:dell_computer:-
Google Android <2026-09-01all versionscert_bundDE
Google Android <2026-09-05all versionscert_bundDE
Google Android< 2026-09-01cert_bundDE
Google Android< 2026-09-05cert_bundDE
Qualcomm, Inc. Snapdragon≤ XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXenisa_euvdEU
qualcomm ar8031 firmwareall versionsnvdUScpe:2.3:o:qualcomm:ar8031_firmware:*:*:*:*:*:*:*:*
qualcomm ar8035 firmwareall versionsnvdUScpe:2.3:o:qualcomm:ar8035_firmware:*:*:*:*:*:*:*:*
qualcomm cologne firmwareall versionsnvdUScpe:2.3:o:qualcomm:cologne_firmware:*:*:*:*:*:*:*:*
qualcomm cq7790 firmwareall versionsnvdUScpe:2.3:o:qualcomm:cq7790_firmware:*:*:*:*:*:*:*:*
qualcomm cq8725s firmwareall versionsnvdUScpe:2.3:o:qualcomm:cq8725s_firmware:*:*:*:*:*:*:*:*
qualcomm cq8750m firmwareall versionsnvdUScpe:2.3:o:qualcomm:cq8750m_firmware:*:*:*:*:*:*:*:*
qualcomm csra6620 firmwareall versionsnvdUScpe:2.3:o:qualcomm:csra6620_firmware:*:*:*:*:*:*:*:*
qualcomm csra6640 firmwareall versionsnvdUScpe:2.3:o:qualcomm:csra6640_firmware:*:*:*:*:*:*:*:*
qualcomm fastconnect 6200 firmwareall versionsnvdUScpe:2.3:o:qualcomm:fastconnect_6200_firmware:*:*:*:*:*:*:*:*
qualcomm fastconnect 6700 firmwareall versionsnvdUScpe:2.3:o:qualcomm:fastconnect_6700_firmware:*:*:*:*:*:*:*:*
qualcomm fastconnect 6900 firmwareall versionsnvdUScpe:2.3:o:qualcomm:fastconnect_6900_firmware:*:*:*:*:*:*:*:*
qualcomm fastconnect 7800 firmwareall versionsnvdUScpe:2.3:o:qualcomm:fastconnect_7800_firmware:*:*:*:*:*:*:*:*
qualcomm flight rb5 5g platform firmwareall versionsnvdUScpe:2.3:o:qualcomm:flight_rb5_5g_platform_firmware:*:*:*:*:*:*:*:*
qualcomm fwa gen 3 ultra firmwareall versionsnvdUScpe:2.3:o:qualcomm:fwa_gen_3_ultra_firmware:*:*:*:*:*:*:*:*

showing 20 of 223

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-3251Android Patchday September 2026: Mehrere SchwachstellenDeutsch2026-09-08csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um beliebigen Code auszuführen, Berechtigungen zu erweitern, vertrauliche Informationen offenzulegen oder Denial-of-Service-Zustände herbeizuführen.
ASB-A-4890799862026-09-01vendor · osvUS

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd osv cert_bund nvd NVD CVE.org MITRE

published 2026-06-01modified 2026-07-22

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan