CVE-2026-0438
Raw vector
CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-0438 is a medium-severity Data Resource Access without Use of Connection Pooling (CWE-1072) vulnerability in Amd (inferred from references). Its CVSS base score is 5.4 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-6 (Resource Availability) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-30496
Vulnerability Data
A System Management Mode (SMM) handler could perform a callout to code located in non-SMM/untrusted memory. A highly privileged attacker could, with active user interaction and under high complexity and present preconditions, trigger execution of attacker-controlled code in SMM, potentially…
more
compromising the system’s confidentiality, integrity, and availability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Resource allocation controls limit exhaustion effects that arise when pooling is omitted.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices can require connection pooling as an efficiency/resilience coding standard.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development life cycle can include architectural guidance on connection pooling but does not specifically enforce it.
Secure system architecture principles may recommend efficient resource management including pooling, yet do not mandate it.
Secure coding standards can discourage direct connection creation but do not explicitly require connection pooling.
Capacity management can indirectly reduce resource exhaustion from unpooled connections but does not mandate pooling.
Redundancy of processing facilities may mitigate availability impact of connection exhaustion but does not require connection pooling.