AMD vulnerabilities & exploitation

Exploitation timeline

Threadlinqs has recorded 7 AMD CVEs published between 2023-08-15 and 2026-09-15. The busiest month was 2026-05 (3 new CVEs). None of them is listed in CISA KEV yet.

Most exploited vulnerabilities

Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 7 of 7 tracked AMD CVEs.

• CVE-2023-20569EPSS 7.3%2023-08-08
• CVE-2023-20598high 7.8EPSS 0.5%2023-10-17
• CVE-2023-20577high 7.4EPSS 0.2%2026-09-02
• CVE-2023-20576high 7.7EPSS 0.1%2026-09-02
• CVE-2025-62624high 8.8EPSS 0.1%2026-05-13
• CVE-2025-62623high 8.8EPSS 0.1%2026-05-13
• CVE-2025-62627high 7.2EPSS 0.1%2026-05-13

Products affected

Threadlinqs normalises CPE and CNA product records across all 7 CVEs; 35 distinct AMD products are affected. The most frequently affected (top 20):

• ESXi 8.x and ESXi 9.x hosts using AMD-Pensando DPU products 3 CVEs
• Ryzen™ 3000 Series Desktop Processors 3 CVEs
• Ryzen™ 4000 Series Desktop Processors with Radeon™ Graphics 3 CVEs
• Ryzen™ 5000 Series Desktop Processors 3 CVEs
• Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics 3 CVEs
• Ryzen™ 6000 Series Processors with Radeon™ Graphics 2 CVEs
• Ryzen™ 7000 Series Processors 2 CVEs
• Ryzen™ 7020 Series Processors with Radeon™ Graphics 2 CVEs
• Ryzen™ 7035 Series Processors with Radeon™ Graphics 2 CVEs
• Ryzen™ 7040 Series Processors with Radeon™ Graphics 2 CVEs
• 2nd Gen AMD EPYC™ Processors 1 CVE
• 3rd Gen AMD EPYC™ Processors 1 CVE
• 4th Gen AMD EPYC™ Processors 1 CVE
• Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics 1 CVE
• Athlon™ 3000 Series Processors with Radeon™ Graphics 1 CVE
• Athlon™ PRO 3000 Series Processors with Radeon™ Vega Graphics 1 CVE
• Instinct™ MI300A 1 CVE
• Radeon™ PRO W5000 Series Graphics Cards 1 CVE
• Radeon™ PRO W6000 Series Graphics Cards 1 CVE
• Radeon™ PRO W7000 Series Graphics Cards 1 CVE

Threat activity

4 tracked threat campaigns reference AMD products or exploit AMD CVEs:

• Spectre-v2 Branch Target Reuse (BTR) Attack Leaks Linux Kernel Memory Despite Existing Defenses (CVE-2026-64507, CVE-2026-64508)HIGH2026-09-29
• Lunex Stealer Abuses Vulnerable AMD Radeon Driver (CVE-2023-20598) to Blind Security Monitoring and Steal Browser/Crypto CredentialsHIGH2026-09-26
• AMD Ionic Cloud Driver Vulnerabilities Affecting VMware ESX (CVE-2025-62623, CVE-2025-62624, CVE-2025-62627)HIGH2026-08-25
• TONTOU: Interrupt-Injection Attack Bypasses Spectre v2 (eIBRS/Safe RET) Defenses on Intel and AMD CPUsHIGH2026-08-06

How to prioritise AMD patching

This order follows the data Threadlinqs holds for AMD, not a generic severity checklist:

• No AMD CVE is in CISA KEV yet, so rank by exploit probability instead.
• Outside KEV, the highest EPSS scores are CVE-2023-20569 (7.3%), CVE-2023-20598 (0.5%), CVE-2023-20577 (0.2%).
• 0 CVEs score Critical and 6 High on CVSS v3 (maximum 8.8, average 8); sequence these after KEV and high-EPSS items.
• 2 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack.

About this data

Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-25 and refresh daily.