Intel TDX MigTD: Escalation of privilege via insufficient access control in policy engine
Summary
The MigTD v2 policy evaluation engine of Intel TDX Migration Trust Domain has insufficient granularity of access control, which may allow a hypervisor-level escalation of privilege. According to the CVSS vector, an attacker needs adjacent network access, high-complexity conditions and no user interaction. The CVSS score of 8.8 is from the CNA record; NVD has not yet analysed it, and the affected and fixed versions could not be verified. Relevance is mainly limited to environments that run Intel TDX confidential VMs with migration.
Affected
Unknown. Intel TDX Migration Trust Domain (MigTD), MigTD v2 policy evaluation engine, per CNA record. Versions not verified.
Fixed in
Unknown. Check Intel advisory INTEL-SA-01580.
Workaround
Unknown. Check Intel advisory INTEL-SA-01580.
Exploitation
- No known exploitation in the wild (not verified against CISA KEV).
- No public proof of concept found.
- NVD status: Received (not yet analysed).
Our recommendation
- If you do not operate Intel TDX hosts with MigTD-based migration, record this as not applicable and re-check later.
- If you do, obtain the Intel advisory INTEL-SA-01580 and the cloud or hardware vendor patch, and prioritise it through your provider.
- Restrict access to migration networks and keep TDX module, firmware and hypervisor patched.
- Note: the description says network adversary while the vector says adjacent (AV:A); verify the real attack vector in the Intel advisory.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Intel Security Advisory INTEL-SA-01580 intel.com
- Intel MigTD GitHub repository github.com
- MigTD releases github.com
- Intel TDX Migration TD Design Guide cdrdv2-public.intel.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 19:22.
Original description (NVD)
Insufficient granularity of access control in the MigTD v2 policy evaluation engine for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. Network adversary with an unauthenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.