Researchers have disclosed two attacks that undermine AMD’s Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP), allowing a hostile cloud operator to extract data from confidential virtual machines. The attacks, dubbed Mior and Skyfall, require control of the host hypervisor—an important limitation, but one that directly matches the threat model SEV-SNP is designed to address.
Mior is tracked by AMD as CVE-2026-0462 and carries a CVSS 4.0 score of 5.9. AMD says a malicious hypervisor can manipulate memory-mapped I/O routing through insufficient access-control granularity in SEV firmware, potentially compromising guest-memory integrity. In the researchers’ demonstration, the attack also enabled memory modification and forged attestation evidence about the software running inside the VM. Mior additionally requires control of the server’s BIOS, raising the operational bar beyond hypervisor compromise alone.
AMD rates Mior as affecting SEV-SNP on EPYC 7003, 8004, 8005, 9004 and 9005 processors, while its advisory says the earlier SEV and SEV-ES modes are not affected. AMD has released SEV firmware mitigations dated Aug. 12, 2026, but the corresponding platform-initialization firmware was scheduled for OEM release in December 2026. Embedded versions of the affected EPYC families were listed for mitigation in February 2027, with versions still to be determined.
Skyfall is tracked as CVE-2026-40671, with a CVSS 4.0 score of 4.9. AMD describes an incomplete cleanup path during VMRUN error handling that can leave SEV-SNP guest register state exposed to a privileged attacker through a transient scheduler side channel. The research demonstrated recovery of register values and other secrets from protected execution; the flaw is an information-disclosure issue rather than a direct mechanism for altering VM memory.
Skyfall affects the same major EPYC server families, according to AMD, which lists microcode mitigations released Aug. 12 and platform-firmware updates targeted for November 2026. Embedded EPYC 7003, 8004, 9004 and 9005 products have later target dates ranging from January to April 2027. AMD’s advisories direct customers to obtain the appropriate BIOS or platform-initialization update from their server OEM and to verify that processor microcode and SEV firmware are also current.
Cloud providers and organizations operating confidential workloads should treat control of a host hypervisor or BIOS as a complete compromise of the confidential-computing boundary until the applicable mitigations are installed. They should inventory EPYC generations and embedded deployments, update OEM platform firmware, processor microcode and SEV firmware, and review attestation and key-release policies so that workloads do not automatically trust an unverified or outdated trusted-computing base. No evidence of exploitation in the wild or attribution to a threat actor was identified in the public advisories reviewed for these disclosures.
