CVE-2026-89172
CVE-2026-89172 is a medium-severity vulnerability with a CVSS 4.0 base score of 5.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1300.
Key facts
- Severity: Medium (CVSS 4.0 base score 5.6)
- EPSS exploit prediction: 0% (9th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-1300
- Published:
- Last modified:
Description
Improper protection of physical side channels vulnerability in Microchip AN1044, Microchip AN953, and Microchip SW300052. This issue affects AN1044: through A; AN953: through A; SW300052: through 2.6.
Frequently asked questions
- What is CVE-2026-89172?
- Improper protection of physical side channels vulnerability in Microchip AN1044, Microchip AN953, and Microchip SW300052. This issue affects AN1044: through A; AN953: through A; SW300052: through 2.6.
- How severe is CVE-2026-89172?
- CVE-2026-89172 has a CVSS 4.0 base score of 5.6, rated medium severity.
- Is CVE-2026-89172 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (9th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-89172?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2026-89172 published?
- CVE-2026-89172 was published on 2026-09-12 and last updated on 2026-09-16.
References
- https://www.microchip.com/en-us/application-notes/an1044
- https://www.microchip.com/en-us/application-notes/an953
- https://www.microchip.com/en-us/development-tool/sw300052
- https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/side-channel-attack-an1044-an953-sw300052-cryptographic-algorithms
Other CWE-1300 vulnerabilities
- CVE-2026-11153 — Critical (CVSS 9.1): Side-channel information leakage in Forms in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak…
- CVE-2026-17800 — Medium (CVSS 6.5): Inappropriate implementation in MediaRecording in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to…
- CVE-2026-17796 — Medium (CVSS 6.5): Side-channel information leakage in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain…
- CVE-2026-14085 — Medium (CVSS 6.5): Side-channel information leakage in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak…
- CVE-2026-14074 — Medium (CVSS 6.5): Side-channel information leakage in WebAuthentication in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote…
- CVE-2026-14071 — Medium (CVSS 6.5): Side-channel information leakage in WebAudio in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak…