Threat reportVulnerabilityTL-2026-5737

Intel Slim Bootloader Multiple Vulnerabilities (INTEL-SA-01526) - CVE-2026-50175, CVE-2026-35500, CVE-2026-41221, CVE-2026-41224, CVE-2026-44624, CVE-2026-28746

highPATCHED

Intel advisory INTEL-SA-01526 (10 Nov 2026) discloses six vulnerabilities in Intel Slim Bootloader firmware (four High, two Medium, CVSS 4.0 up to 8.6) that could allow escalation of privilege, denial of service or data corruption. Intel recommends updating Slim Bootloader to commit 9e77d9abb867e7ab4fec8249035cf9ba6550aed7 (7 July 2026) or later; no exploitation or public PoC is stated in the sources.

Key facts

Identifiers	TL-2026-5737, CVE-2026-50175, CVE-2026-35500, CVE-2026-41221, CVE-2026-41224, CVE-2026-44624, CVE-2026-28746, CVE-2026-20753
Also known as	INTEL-SA-01526, ESB-2026.14273
Severity	HIGH
CVSS	8.6 (CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
First disclosed	2026-11-10
Affected products	Intel Slim Bootloader
Weaknesses (CWE)	CWE-822, CWE-121, CWE-190, CWE-787, CWE-697, CWE-125
MITRE ATT&CK techniques	T1542.001 System Firmware, T1565 Data Manipulation
Motivation	UNKNOWN
Target sectors	technology, manufacturing, telecoms, critical-infrastructure
Target regions	Global
Detection rules	9 (1 shown free)
Sources	8 cited sources

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5737 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-5737 Firmware Flash / SPI Write Tool Execution (Slim Bootloader INTEL-SA-01526)

Detects execution of firmware flashing and SPI/chipset access utilities (flashrom, Intel FPT, AMI AFU, fwupdtool, CHIPSEC) with write-style arguments or Slim Bootloader image references. Intel INTEL-SA-01526 (CVE-2026-50175, CVE-2026-35500, CVE-2026-41221, CVE-2026-41224, CVE-2026-44624, CVE-2026-28746) is a firmware class of flaw with no reported in-the-wild exploitation, so this rule is behaviour-first: it surfaces the tooling an adversary with local privilege would need to read, replace or implant boot firmware (T1542.001) and escalate beyond the OS (T1068).

Languages: Splunk SPL, Microsoft KQL, Sigma
ATT&CK: T1542.001, T1068
Data sources: sysmon (index=sysmon, sourcetype XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, EventCode 1), DeviceProcessEvents, windows process_creation
Severity: high
Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h (Image="*flashrom.exe" OR Image="*fptw64.exe" OR Image="*fptw.exe" OR Image="*afuwinx64.exe" OR Image="*afuwin.exe" OR Image="*fwupdtool.exe" OR Image="*chipsec_main.exe" OR Image="*chipsec_util.exe" OR Image="*spiflash.exe")
| where match(CommandLine, "(?i)( -w | --write| -f |-bios|-rom|-spi|slimbootloader|sbl|ibb|[.]rom|[.]fd|[.]cap)")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images values(User) as users by host Image
| eval first_seen=strftime(first_seen,"%Y-%m-%dT%H:%M:%SZ"), last_seen=strftime(last_seen,"%Y-%m-%dT%H:%M:%SZ"), detection="TL-2026-5737 INTEL-SA-01526 firmware write tool"
| table host users Image parent_images command_lines count first_seen last_seen detection

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ('flashrom.exe','fptw64.exe','fptw.exe','afuwinx64.exe','afuwin.exe','fwupdtool.exe','chipsec_main.exe','chipsec_util.exe','spiflash.exe')
| where ProcessCommandLine matches regex @'(?i)( -w | --write| -f |-bios|-rom|-spi|slimbootloader|sbl|ibb|[.]rom|[.]fd|[.]cap)'
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc

Sigma

title: Firmware Flash or SPI Access Utility Execution (TL-2026-5737 Slim Bootloader INTEL-SA-01526)
id: 3f8e2b61-9a4d-4c7e-b1d2-5a60c7e48f13
status: experimental
description: Detects execution of firmware flashing and SPI or chipset access utilities with write style arguments on Windows hosts. Precursor behaviour for Intel Slim Bootloader firmware tampering (CVE-2026-50175, CVE-2026-35500, CVE-2026-41221, CVE-2026-41224). No in the wild exploitation of INTEL-SA-01526 is reported, so this is a hunting and exposure rule.
references:
  - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01526.html
  - https://github.com/slimbootloader/slimbootloader/commit/9e77d9abb867e7ab4fec8249035cf9ba6550aed7
author: Threadlinqs Team
date: 2026/11/11
tags:
  - attack.persistence
  - attack.defense_evasion
  - attack.t1542.001
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026-50175
  - cve.2026-35500
  - cve.2026-41221
  - cve.2026-41224
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\flashrom.exe'
      - '\fptw64.exe'
      - '\fptw.exe'
      - '\afuwinx64.exe'
      - '\afuwin.exe'
      - '\fwupdtool.exe'
      - '\chipsec_main.exe'
      - '\chipsec_util.exe'
      - '\spiflash.exe'
  selection_args:
    CommandLine|contains:
      - ' -w '
      - '--write'
      - ' -f '
      - '-bios'
      - '-rom'
      - '-spi'
      - 'slimbootloader'
      - '.rom'
      - '.cap'
  condition: selection_img and selection_args
falsepositives:
  - Authorised BIOS or firmware updates run by IT or OEM tooling
  - Firmware engineers and lab systems
level: high

Known false positives:

Authorised BIOS/firmware updates run by IT, OEM update agents or imaging pipelines
Firmware engineering, lab and manufacturing hosts that flash devices daily

Tuning notes: Allowlist known firmware engineering hosts and signed OEM update parents (ParentImage). Replace index=sysmon with the index that holds your Sysmon data. Extend the Image list with any vendor flashers in your estate (e.g. OEM-specific flash utilities).

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)

TL-2026-5737 Boot Integrity and Secure Boot Tampering (bcdedit / SecureBoot State) · unlock with TL Creds
TL-2026-5737 Firmware / Bootloader Image File Written by Non-Update Process · unlock with TL Creds
TL-2026-5737 Remote Execution of Firmware Flash Tools Across Hosts · unlock with TL Creds
TL-2026-5737 Linux Firmware Flash / CHIPSEC Tool Execution on Slim Bootloader Platforms · unlock with TL Creds
TL-2026-5737 Raw Flash/Memory Device Write or SPI Kernel Module Load on Linux · unlock with TL Creds
TL-2026-5737 Ext2 Image Crafting or Editing (SBL Ext2 Parser CVE-2026-44624) · unlock with TL Creds
TL-2026-5737 Firmware / Physical-Memory Access Driver Load (SBL SMM & Boot Firmware Precursor) · unlock with TL Creds
TL-2026-5737 Repeated S3 Sleep/Resume Faults (FirmwareWakingVector CVE-2026-50175 Impact Signal) · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-5737.

Sample indicators (1 of 11)

File hash: 9e77d9abb867e7ab4fec8249035cf9ba6550aed7

Defanged, TLP:CLEAR. Full set of 11 indicators: unlock with TL Creds.

11 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

INTEL-SA-01526 (revision 1.0, released 2026-11-10, category Firmware, severity High) covers six weaknesses in Intel Slim Bootloader (SBL), an open-source boot firmware used on Intel client, embedded and server platforms.

Four issues are rated High under CVSS 4.0. CVE-2026-50175 (8.4) is an untrusted pointer dereference (CWE-822 per NVD) in the FirmwareWakingVector handling; it requires a privileged local system-software adversary, low attack complexity and no user interaction, with high confidentiality/integrity/availability impact on the vulnerable system (reported by vic5589). CVE-2026-35500 (stack-based buffer overflow), CVE-2026-41221 (integer overflow) and CVE-2026-41224 (out-of-bounds write) are all in the UEFI firmware component, each scored 8.6 with vector AV:P/AC:L/PR:N and high impact including subsequent systems; Intel describes an unauthenticated adversary with physical access using startup code or SMM who could escalate privileges. These three were found internally by Intel (credited to Brent Holtsclaw).

Two issues are Medium. CVE-2026-44624 (5.7) is an incorrect comparison in the Ext2 parser (reported by vic5589); the advisory lists impact as denial of service for the header and data corruption for the body, and the advisory's own impact text and summary differ. CVE-2026-28746 (6.7) is an out-of-bounds read in AuthenticateComponent that allows a privileged local adversary to cause denial of service (reported by 0xraban).

Affected platforms are listed by processor family: Alder Lake, Arizona Beach, Amston Lake, Twin Lake, Apollo Lake (Atom E3900), Arrow Lake, Bartlett Lake-S, Raptor Lake, Coffee Lake (Xeon E), Comet Lake, Elkhart Lake, Ice Lake-D, Eddy Lake, Granite Rapids-D, Meteor Lake, Panther Lake and Tiger Lake, with 30 CPUID values; no firmware version numbers are given and the per-CPUID mapping is unclear on the page. The remediation is to update Slim Bootloader to commit 9e77d9abb867e7ab4fec8249035cf9ba6550aed7 (dated 2026-07-07) or later. The advisory provides no CVSS 3.1 scores, no CWE identifiers other than CWE-822 on the NVD record for CVE-2026-50175, and no workarounds. The AUSCERT bulletin ESB-2026.14273 is member-only and redacted. The referenced upstream commit changes the ACPI/FPDT S3-resume code (adds ValidateAcpiPointerInS3 pointer-range checks in AcpiFpdt.c and AcpiInitLib.c); the commit message does not explicitly name the six CVEs, so the mapping of that commit to individual CVEs is not confirmed by the sources. No source states active exploitation, a public PoC, or CISA KEV listing (the CVEs were not found in the portion of the KEV catalog that could be read; the catalog was truncated).

MITRE ATT&CK techniques by tactic:

Remediation

Patches

Intel Slim Bootloader commit 9e77d9abb867e7ab4fec8249035cf9ba6550aed7 or later

Immediate actions

Update Intel Slim Bootloader to commit 9e77d9abb867e7ab4fec8249035cf9ba6550aed7 (2026-07-07) or later
Inventory devices and products built on Slim Bootloader and request fixed firmware from OEM/ODM vendors

Longer-term hardening

Restrict physical access to affected embedded and edge devices
Enable Boot Guard / verified boot and monitor firmware measurements for unexpected changes
Track Intel PSIRT advisories for Slim Bootloader (see also INTEL-SA-01475)

Affected and fixed versions

Intel — Slim Bootloader
Vulnerable versions: Builds before commit 9e77d9abb867e7ab4fec8249035cf9ba6550aed7 (2026-07-07) on listed processor families: Alder Lake, Arizona Beach, Amston Lake, Twin Lake, Apollo Lake, Arrow Lake, Bartlett Lake-S, Raptor Lake, Coffee Lake, Comet Lake, Elkhart Lake, Ice Lake-D, Eddy Lake, Granite Rapids-D, Meteor Lake, Panther Lake, Tiger Lake
Fixed in: Commit 9e77d9abb867e7ab4fec8249035cf9ba6550aed7 or later

Timeline

2026-04-22 Earlier Slim Bootloader advisory INTEL-SA-01475 (CVE-2026-28729, CVE-2026-25194) recommends a build dated 22 April 2026 or later, showing a continuing series of SBL firmware fixes
2026-05-12 CVE-2026-20753, an earlier Slim Bootloader integer overflow allowing privilege escalation (CVSS 4.0 8.7), is published
2026-07-07 Slim Bootloader commit locked-ioc-5 is dated; Intel names it as the minimum fixed version for INTEL-SA-01526
2026-11-10 NVD publishes CVE-2026-50175 (CWE-822, CVSS 4.0 8.4) with status Awaiting Analysis
2026-11-10 Intel publishes INTEL-SA-01526 (revision 1.0) covering six Slim Bootloader CVEs
2026-11-11 AUSCERT issues member-only bulletin ESB-2026.14273 for the Intel Slim Bootloader advisory

Sources cited

AUSCERT ESB-2026.14273 - Intel Slim Bootloader (member-only, redacted) portal.auscert.org.au · Advisory · 2026-11-11
NVD - CVE-2026-50175 NVD (NIST) · Advisory · 2026-11-10
NVD - CVE-2026-20753 (earlier SBL integer overflow EoP) NVD (NIST) · Advisory · 2026-05-12
CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory
Intel Slim Bootloader Advisory INTEL-SA-01526 intel.com · Vendor report · 2026-11-10
Intel Slim Bootloader Advisory INTEL-SA-01475 (earlier SBL advisory) intel.com · Vendor report
Slim Bootloader fix commit 9e77d9a (FPDT S3 pointer validation) GitHub · Code repository · 2026-07-07
Slim Bootloader project repository GitHub · Code repository

Previous and next in vulnerability

Drafted by the Threadlinqs research pipeline from 8 sources; published 2026-11-11; last updated —.

Intel Slim Bootloader Multiple Vulnerabilities (INTEL-SA-01526) - CVE-2026-50175, CVE-2026-35500, CVE-2026-41221, CVE-2026-41224, CVE-2026-44624, CVE-2026-28746

Key facts

Detection coverage

Free detection: TL-2026-5737 Firmware Flash / SPI Write Tool Execution (Slim Bootloader INTEL-SA-01526)

Splunk SPL

Microsoft KQL

Sigma

Indicators of compromise

Sample indicators (1 of 11)

Technical analysis

Persistence

Defense Evasion

Impact

Remediation

Patches

Immediate actions

Longer-term hardening

Affected and fixed versions

Timeline

Sources cited

Previous and next in vulnerability

Latest Threats

🔄 Threat Comparison

Intel Slim Bootloader Multiple Vulnerabilities (INTEL-SA-01526) - CVE-2026-50175, CVE-2026-35500, CVE-2026-41221, CVE-2026-41224, CVE-2026-44624, CVE-2026-28746

Key facts

Detection coverage

Free detection: TL-2026-5737 Firmware Flash / SPI Write Tool Execution (Slim Bootloader INTEL-SA-01526)

Splunk SPL

Microsoft KQL

Sigma

Indicators of compromise

Sample indicators (1 of 11)

Technical analysis

Persistence

Defense Evasion

Impact

Remediation

Patches

Immediate actions

Longer-term hardening

Affected and fixed versions

Timeline

Sources cited

More in vulnerability

Previous and next in vulnerability

Latest Threats

🔄 Threat Comparison