CVE-2026-89172

Side-channel attack of AN1044/AN953/SW300052 cryptographic algorithms

MEDIUM

5.6

CVSS Score

Published: September 12, 2026 at 09:26 AM UTC

Updated: September 16, 2026 at 07:44 PM UTC

3 products affected across 1 vendorSW300052AN953AN1044

Using AN1044 by Microchip?

Get instant alerts when new vulnerabilities affect AN1044 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.6

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

Improper protection of physical side channels vulnerability in Microchip AN1044, Microchip AN953, and Microchip SW300052. This issue affects AN1044: through A; AN953: through A; SW300052: through 2.6.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

AN1044 · Microchip

60%

v ≤ A

AN953 · Microchip

60%

v ≤ A

SW300052 · Microchip

60%

v ≤ 2.6

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/side-channel-attack-an1044-an953-sw300052-cryptographic-algorithms

References (4)

Vendor Advisory

Source: cverecord

https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/side-channel-attack-an1044-an953-sw300052-cryptographic-algorithms

Source: cverecord

https://www.microchip.com/en-us/application-notes/an1044

Source: cverecord

https://www.microchip.com/en-us/application-notes/an953

Source: cverecord

https://www.microchip.com/en-us/development-tool/sw300052

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.6MEDIUMMicrochip

Vector?

Quick Info

StatusAWAITING ANALYSIS

CWE

CWE-1300

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card