CVE-2026-20752: Intel PROSet WiFi Information Disclosure

CVE-2026-20752 Overview

CVE-2026-20752 is an improper authentication vulnerability [CWE-287] affecting Intel PROSet/Wireless WiFi Software components that execute within Ring 0 (kernel mode). The flaw allows a local attacker with high privileges to trigger information disclosure from the affected system. Exploitation requires no user interaction and no special internal knowledge. The vulnerability impacts only the confidentiality of the vulnerable system. Integrity and availability are not affected, and subsequent system components remain unaffected.

Critical Impact
A privileged local attacker can leverage improper authentication in kernel-mode Intel PROSet/Wireless WiFi Software to disclose sensitive data with low attack complexity.

Affected Products

Intel PROSet/Wireless WiFi Software (kernel-mode components)
Refer to Intel Security Advisory SA-01468 for the complete list of affected versions
Windows systems running vulnerable Intel wireless driver stacks

Discovery Timeline

2026-08-11 - CVE-2026-20752 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-20752

Vulnerability Analysis

The vulnerability resides in kernel-mode components (Ring 0) of Intel PROSet/Wireless WiFi Software. Improper authentication in privileged code paths permits a system software adversary to read information that should remain protected. Because the affected code executes in kernel mode, disclosed data may include kernel memory contents, driver state, or configuration secrets that are normally isolated from user-mode processes. The vulnerability is local in nature and requires an attacker already holding elevated privileges on the host. Exploitation does not require user interaction, and the attack complexity is low once the prerequisite privilege level is obtained.

Root Cause

The root cause is improper authentication [CWE-287] within Ring 0 code paths of the Intel PROSet/Wireless WiFi Software. The driver does not adequately verify the identity or authorization of the caller before returning data through a privileged interface. This allows a caller that reaches the interface to obtain information that should be restricted based on caller identity or trust level.

Attack Vector

Exploitation is local. An adversary running code with high privileges on the target host interacts with the vulnerable kernel-mode component and elicits an information disclosure response. No network access, no user interaction, and no additional attack requirements are needed once local privileged execution is achieved. Typical prerequisites include prior code execution via another vulnerability, a malicious signed driver load, or misuse of an administrative session.

No public proof-of-concept code is available. See the Intel Security Advisory SA-01468 for vendor technical details.

Detection Methods for CVE-2026-20752

Indicators of Compromise

Unexpected loading or interaction with Intel PROSet/Wireless WiFi kernel drivers by non-standard processes
Elevated processes issuing DeviceIoControl calls to Intel wireless driver device objects outside of Intel management utilities
Presence of outdated Intel PROSet/Wireless WiFi Software versions not listed as remediated in Intel SA-01468

Detection Strategies

Inventory endpoints for Intel PROSet/Wireless WiFi driver and software versions and compare against the fixed versions in Intel SA-01468
Monitor for privileged local processes accessing Intel wireless driver IOCTL interfaces where such access is not expected
Correlate driver-load telemetry with process ancestry to identify non-Intel binaries interacting with kernel-mode wireless components

Monitoring Recommendations

Enable kernel driver load auditing and forward events to a centralized log platform
Track privilege-use events on hosts with Intel wireless hardware to identify abuse of administrative sessions
Alert on installation of Intel PROSet/Wireless WiFi versions predating the SA-01468 remediation

How to Mitigate CVE-2026-20752

Immediate Actions Required

Apply the Intel PROSet/Wireless WiFi Software update referenced in Intel Security Advisory SA-01468
Restrict local administrative privileges on endpoints with vulnerable Intel wireless drivers
Audit third-party drivers and administrative tooling that interact with Intel wireless device objects

Patch Information

Intel has published remediation guidance in Intel Security Advisory SA-01468. Update Intel PROSet/Wireless WiFi Software to the fixed release listed in the advisory. Both the driver and the associated management software should be updated together to ensure the kernel-mode component is replaced.

Workarounds

Where updating is not immediately possible, limit interactive and remote administrator access to affected hosts
Disable or uninstall Intel PROSet/Wireless WiFi Software on systems that do not require Intel wireless functionality
Enforce application allowlisting to block unauthorized privileged binaries from interacting with the vulnerable driver

bash

# Windows: check installed Intel PROSet/Wireless WiFi Software version
Get-CimInstance -ClassName Win32_Product | \
  Where-Object { $_.Name -like "*Intel*PROSet*Wireless*" } | \
  Select-Object Name, Version, Vendor