PatchTheCVECVE-2024-7726: There exists an unauthenticated accessible JTAG port on the Kioxia PM6, PM7 and CM6 devices - On the Kioxia CM
CVE-2024-7726 is a medium-severity flaw (CVSS 6.8) affecting cm6 firmware, pm7 firmware, pm6 firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
There exists an unauthenticated accessible JTAG port on the Kioxia PM6, PM7 and CM6 devices - On the Kioxia CM6, PM6 and PM7 disk drives it was discovered that the 2 main CPU cores of the SoC can be accessed via an open JTAG debug port that is exposed on the drive’s circuit board. Due to the wide cutout of the enclosures, the JTAG port can be accessed without having to open the disk enclosure. Utilizing the JTAG debug port, an attacker with (temp
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.8 (Medium) |
| Attack vector | Physical |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 65%) |
| CISA exploited list | No |
| Weakness | CWE-306 |
| Published | 2024-12-20 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-7726?
cm6 firmware: upgrade to newer than gpk5; pm7 firmware: upgrade to newer than c40a; pm6 firmware: upgrade to newer than bd0d. Exact commands for each OS are on this page.
Is CVE-2024-7726 being exploited?
CVE-2024-7726 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-7726 affect?
CVE-2024-7726 affects cm6 firmware, pm7 firmware, pm6 firmware. Severity is medium (CVSS 6.8). There exists an unauthenticated accessible JTAG port on the Kioxia PM6, PM7 and CM6 devices - On the Kioxia CM6, PM6 and PM7 disk drives it was discovered that the 2 main CPU cores of the SoC can be accessed via an open JTAG debug port that
How urgent is CVE-2024-7726?
Priority 38/100. Public exploit reference