Cybersecurity researchers from ETH Zurich and Google disclosed two distinct vulnerabilities in AMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) on November 13, 2026. Designated Mior (CVE-2026-0462) and Skyfall (CVE-2026-40671), the flaws demonstrate that a compromised host hypervisor or rogue system firmware can breach the hardware-enforced boundaries of confidential virtual machines to exfiltrate cryptographic keys, tamper with memory, and forge attestation reports.
AMD SEV-SNP provides the architectural foundation for confidential computing deployments, ensuring that even a host with root hypervisor access cannot read or alter guest memory. The dual disclosure directly challenges the zero-trust hypervisor model across AMD EPYC server microarchitectures spanning Zen 3, Zen 4, and Zen 5 hardware.
Hardware Initialisation Flaw: How Mior Manipulates RMP Integrity
The Mior vulnerability (CVE-2026-0462, CVSS 5.9 in AMD bulletin AMD-SB-3059), identified by ETH Zurich, targets the boot-time initialization of the Reverse Map Table (RMP). The RMP is managed by AMD Platform Security Processor (PSP) firmware to enforce page ownership and access permissions for confidential guests.
An attacker controlling the hypervisor and BIOS manipulates Memory-Mapped I/O (MMIO) routing during boot, redirecting PSP write operations to a secondary PCIe device such as a graphics card. Because the device returns matching responses during verification, boot completes while leaving critical RMP entries uninitialized. The hypervisor can then enable PSP debug commands on running guests. In lab benchmarks on an AMD EPYC 9135 Zen 5 server, researchers gained arbitrary read and write access to encrypted guest memory across all 1,000 test trials, bypassing ciphertext hiding. The team also demonstrated attestation forgery, transplanting measurement hashes from benign virtual machines to pass attestation checks.
Microarchitectural Side Channels: Skyfall and Transient Execution Leaks
Disclosed by ETH Zurich and Google, Skyfall (CVE-2026-40671, CVSS 4.9 in bulletin AMD-SB-3061) operates entirely at the software and microarchitectural layer. It builds on Transient Scheduler Attacks (TSA), an architectural flaw class first disclosed in July 2025.
Skyfall targets the VMRUN transition sequence. When a malicious hypervisor forces early start-up aborts, the processor caches sensitive virtual machine architectural state without executing standard cleanup routines. Using transient scheduler timing analysis, a rogue host can extract cached register values. Paired with single-stepping frameworks such as SEV-Step, researchers recovered guest disk-encryption keys. Lab tests across AMD EPYC 7313 (Zen 3), 9124 (Zen 4), and 9334 (Zen 4) chips demonstrated register leaks and memory exfiltration from three specific cache lines (offsets 0x0c0, 0x380, and 0x3c0). The flaw also enabled reading decrypted microcode updates and System Management Mode registers, tracked as CVE-2026-18448.
Affected EPYC Processors and Firmware Mitigation Schedule
AMD advisories confirm that Mior and Skyfall affect five enterprise server processor lines: EPYC 7003 (Milan), 8004 (Siena), 8005 (Turin), 9004 (Genoa), and 9005 (Turin), along with Instinct MI300A accelerators. Embedded EPYC models are scheduled for patches between January and April 2027.
Remediation requires applying updated SEV firmware and platform microcode through server OEM BIOS updates. AMD released SEV firmware updates (versions 1.3A.03, 1.3A.4, and 1.3A.0A) and microcode dated August 12, with AGESA Platform Initialization (PI) packages rolling out across November and December 2026. Supermicro has published advisories covering affected H12, H13, and H14 server motherboards, noting that Baseboard Management Controller updates are also required. Because the flaws reside below the guest operating system, tenant virtual machines cannot patch themselves.
Implications for University Research Computing and Regulated Data Enclaves
The disclosure poses immediate challenges for university high-performance computing centers and academic medical institutes. Academic institutions frequently deploy confidential virtual machines to isolate sensitive research workloads within a secure data enclave or trusted research environment. These systems process electronic health records, genomic data, controlled technical data governed by NIST SP 800-171 compliance standards, and artificial intelligence training pipelines.
By demonstrating that a compromised host layer can undermine confidential VM boundaries, Mior and Skyfall complicate compliance verification in hybrid cloud environments. To protect datasets governed by an institutional data management plan, research computing facilities must enforce strict cryptographic remote attestation. Automated provisioning workflows must verify that host attestation reports reflect patched AMD Trusted Computing Base (TCB) version numbers before sensitive research data or decryption keys are unsealed in cloud virtual machines.
Sources
- The Hacker News: New Mior and Skyfall Attacks Let Rogue Cloud Hosts Steal Secrets From AMD SEV-SNP VMs (Checked 2026-11-14).
- AMD Product Security: AMD-SB-3059: AMD SEV-SNP Reverse Map Table (RMP) Initialization Vulnerability (CVE-2026-0462) (Checked 2026-11-14).
- AMD Product Security: AMD-SB-3061: AMD SEV-SNP VMRUN Transient Execution Vulnerability (CVE-2026-40671) (Checked 2026-11-14).
- ETH Zurich Computer Security Group: Mior: Interconnect Corruption Attacks on AMD SEV-SNP (Checked 2026-11-14).
- ETH Zurich and Google: Skyfall: Transient Execution and Architectural Attacks on AMD SEV-SNP (Checked 2026-11-14).
- Supermicro Support: Security Advisory: AMD-SB-3059 BIOS and BMC Updates (Checked 2026-11-14).
