CVE-2025-62619

Published May 14, 2026 CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Description
Missing authentication in the KVM key download endpoint could allow an unauthenticated attacker with knowledge of the exposed URL to retrieve sensitive keys, potentially leading to loss of confidentiality.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description Missing authentication in the KVM key download endpoint could allow an unauthenticated attacker with knowledge of the exposed URL to retrieve sensitive keys, potentially leading to loss of confidentiality.
Weaknesses CWE-306
References
Metrics cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

Weaknesses

Sources

Status
PUBLISHED
Assigner
AMD
Published
Updated
May 14, 2026, 3:35 PM
Reserved
Oct 16, 2025, 8:46 PM
Status
Awaiting Analysis
Published
May 14, 2026, 3:16 PM
Modified
Jun 17, 2026, 9:52 AM