Intel and AMD together patched more than 200 vulnerabilities in their November Patch Tuesday advisories, with Intel’s release including a remote code execution flaw in its Trusted Domain Extensions technology and AMD’s release containing no critical-rated bugs.
The advisories affect firmware and confidential-computing components, categories that sit below the operating system and are slower to update than application software.
Intel’s 24 Advisories Include a TDX Migration Trust Domain RCE
Intel published 24 advisories covering more than 100 vulnerabilities, of which three are critical and 20 are high severity. The notable flaw is CVE-2026-61887, in the TDX Migration Trust Domain, which allows remote code execution. Intel’s TDX MigTD reference software alone accounted for 30 flaws.
Affected products include TDX MigTD, Slim Bootloader, VTune and PROSet/Wireless. Trust Domain Extensions is a technology designed to isolate virtual machines in confidential-computing deployments, so a code execution bug in the migration component touches the layer meant to protect sensitive workloads.
Discontinued BigDL Product Will Not Receive Fixes
Intel will not patch three medium-severity privilege-escalation bugs in BigDL, a product it has discontinued. Organizations still running BigDL face unresolved issues and, as the product is no longer supported, will need to consider removing or isolating it.
AMD’s Roughly 100 CVEs Include 44 Graphics Flaws
AMD released 29 bulletins plus two briefs addressing about 100 CVEs, none critical. Graphics products account for 44 of the flaws, and affected product lines include Radeon, Instinct, Management Console and Vivado. The release also covers UEFI and IOMMU bugs.
Research Tie-Ins and Mitigations Extending Into 2027
Some of AMD’s items tie to published research, including Transient Scheduler Attacks on Zen 5 processors and an EDK II SMM memory inference issue. AMD says some mitigations extend into 2027, which means not every fix is available now and affected customers will be waiting on further updates.
The multi-year timeline is typical of microarchitectural and firmware problems, where mitigation often involves coordinated updates from chipmakers, system vendors and operating system developers rather than a single patch.
Firmware Patching Lags Behind Software Patching
Firmware and silicon-level flaws are harder to close than application bugs. Updates often travel through motherboard and server vendors before they reach end users, and administrators must schedule reboots or maintenance windows. That delay lengthens the period during which a disclosed flaw stays exploitable.
The Intel TDX flaw is the most consequential in operational terms because confidential computing is marketed on the premise that the host environment cannot see inside protected workloads. A remote code execution bug in a related component tests that premise, even though no exploitation has been reported.
For enterprises, the volume of advisories is itself a challenge. More than 200 combined fixes require inventory work to identify which processors, graphics products and firmware components are actually deployed, and which vendor channels will deliver updates. Organizations that use TDX-based confidential computing, or that depend on AMD graphics and management software, should map those dependencies to the relevant advisories and track which patches remain pending.
Intel and AMD Advisory Details by Product Family
On Intel’s side, the affected list extends beyond TDX MigTD to the Slim Bootloader, VTune and PROSet/Wireless products. The advisory count of 24 and the split of three critical and 20 high-severity issues show a release weighted toward serious findings, not minor ones.
AMD’s release is broader and lower in severity. Its 29 bulletins and two briefs include UEFI and IOMMU issues alongside the graphics flaws, and its Management Console and Vivado products are also on the list. Because none is rated critical, the main planning challenge for AMD customers is volume and the long tail of mitigations that run into 2027.
