Asus Pulls AM4 Mitigation BIOS After AMD Links It to TPM-2.0 Flaws
Asus has removed specific BIOS downloads for multiple AM4 motherboards—versions built around AGESA ComboV2 PI 1.2.0.12—after AMD tied that exact firmware branch to mitigations for two TPM-2.0 related vulnerabilities. The practical impact is straightforward for anyone who hasn’t updated yet: the “official” Asus support pages currently no longer provide the mitigation BIOS.
What Asus changed on several AM4 boards
For a range of B550 and X570 motherboards, Asus has withdrawn BIOS versions that include AGESA 1.2.0.12 (and, on affected models, the AGESA ComboV2 PI 1.2.0.12 variant) from its download area. Owners who already installed those specific BIOS releases are not automatically facing any required action, and Asus has not issued guidance urging users to downgrade or claiming that the removed firmware versions themselves create a direct security risk.
However, if you are still on older firmware and were looking to obtain the mitigation through Asus’s official support pages, the needed BIOS entries are currently missing for multiple models.
The security reason: AMD’s TPM mitigations
AMD lists ComboAM4v2 PI 1.2.0.12 in its security bulletin (AMD-SB-7064) as a mitigation for CVE-2026-6726 and CVE-2026-6727 affecting certain AM4 processor configurations. Both vulnerabilities relate to TPM 2.0 implementations and, under particular conditions, may expose or affect cryptographic key material.
Because the Asus support pages no longer offer that referenced AGESA level, the official download path to the AMD-described mitigation is not available for the impacted motherboard SKUs at this time.
That said, the situation is not automatically equivalent to “every system on older BIOS is vulnerable.” The available information does not establish that older firmware versions (such as those with other AGESA releases) lack the required fixes—Asus has not confirmed whether the mitigations are included elsewhere.
Which boards are affected
A reassessment of Asus’s official support listings indicates that the removed BIOS versions are missing for at least six tested models:
- Asus Prime B550-Plus
- Asus ROG Strix B550-F Gaming
- Asus ROG Strix B550-A Gaming
- Asus TUF Gaming B550M-Plus WiFi
- Asus ROG Crosshair VIII Hero WiFi
No public explanation from Asus
Asus has not publicly stated why these BIOS packages were withdrawn. The fact that multiple boards across different product lines show the same pattern (including models from both B550 and X570) suggests it is unlikely to be a single isolated bad download entry.
Long before AMD’s TPM security guidance became widely discussed, users on forums had already reported issues after some BIOS updates—examples mentioned include unexpected behavior around DRAM settings and, in some cases, problems involving NVMe drives.
What users should do now
If you already installed BIOS versions that were later pulled from Asus’s site (the report specifically mentions BIOS 3641 and 5503 as already installed in some cases), Asus has not called for a mandatory downgrade, and there is currently no statement that the removed files pose a direct security hazard on their own.
For users who have not updated yet, the mitigation BIOS referenced by AMD is not available via Asus’s official download pages for the affected models. The guidance in the report also discourages relying on unofficial mirrors while the withdrawal reason remains unclear.
Key takeaways
- Asus has removed BIOS downloads containing AGESA 1.2.0.12 / AGESA ComboV2 PI 1.2.0.12 from multiple B550 and X570 AM4 motherboards.
- AMD’s security bulletin names ComboAM4v2 PI 1.2.0.12 as a mitigation for CVE-2026-6726 and CVE-2026-6727.
- For at least six tested Asus models, the mitigation BIOS is currently missing from Asus’s official support pages.
- Asus has not yet explained the withdrawal, and it has not recommended downgrading for users who already installed the referenced BIOS versions.
