What is the current recommended process for deploying TPM firmware updates related to CVE-2026-6726 and CVE-2026-6727? Historically, updates sometimes required BitLocker and VT-x to be disabled. Do modern systems still need those changes, or can the firmware be updated while BitLocker is suspended?
1 Answer
In our environment, Dell Command Update handles TPM firmware updates through BIOS updates and automatically suspends or disables BitLocker as needed. The exact behavior depends on the TPM generation and the vendor’s update package.
Newer TPMs generally only require BitLocker to be suspended temporarily. Older TPMs may require full decryption, followed by re-encryption, which leaves the machine less protected during the process.
The update process does not always re-enable BitLocker properly afterward, so we verify encryption manually or through management tooling once the device has restarted.