PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-7328 Caliptra CVE debrief

A medium-severity vulnerability was found in Caliptra Core Runtime Firmware version 2.1.0. The issue is caused by missing authorization for INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, and EXTERNAL_MAILBOX_CMD commands in subsystem mode. This allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AXI addresses. The security impact beyond availability is integration-specific. Organizations should review their deployments and apply patches or mitigations as needed.

Vendor
Caliptra
Product
Core Runtime Firmware
CVSS
MEDIUM 6.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-22
Original CVE updated
2026-07-22
Advisory published
2026-07-22
Advisory updated
2026-07-22

Who should care

Organizations using Caliptra Core Runtime Firmware version 2.1.0 should prioritize patching this vulnerability to prevent potential denial-of-service attacks. Security teams and operators should review their deployments and apply vendor guidance. Vulnerability management and platform security teams should assess the impact and implement compensating controls if needed.

Technical summary

The vulnerability is caused by missing authorization for INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, and EXTERNAL_MAILBOX_CMD commands in subsystem mode. This allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AXI addresses. The affected product is Caliptra Core Runtime Firmware version 2.1.0. Defenders should focus on patching and restricting access to the affected system.

Defensive priority

Medium

Recommended defensive actions

  • Apply the vendor-provided patch for Caliptra Core Runtime Firmware version 2.1.0.
  • Restrict access to the affected system to authorized personnel only.
  • Monitor system logs for suspicious activity related to mailbox commands.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record was published on 2026-07-22T17:16:59.557Z and last modified on 2026-07-22T20:40:57.147Z. The NVD entry is currently Awaiting Analysis. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the vendor. The issue is caused by missing authorization for certain commands, allowing a privileged local attacker to cause a denial of service. Evidence is limited to CVE and NVD details.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-22T17:16:59.557Z and has not been modified since then. The NVD entry is currently Awaiting Analysis.