Intel TDX MigTD: Incomplete internal state handling in SPDM responder
Summary
The SPDM responder of the Intel TDX Migration Trust Domain (MigTD), a service component used for moving confidential VMs between TDX hosts, does not correctly distinguish its internal state. A privileged local or adjacent attacker, for example a malicious administrator or software at hypervisor level, may be able to corrupt data and cause a privilege escalation. The CVSS 4.0 score of 6.8 reflects an integrity impact on the vulnerable system only, and no user interaction is required. Exposure is limited to TDX-capable Intel server platforms that run MigTD.
Affected
- Intel TDX Migration Trust Domain (MigTD), exact versions unknown (the CVE record only states "See references")
Fixed in
Unknown. Check Intel advisory INTEL-SA-01580 for the affected versions and fixed releases.
Workaround
- Unknown. No vendor workaround has been confirmed.
- Restrict administrative access to hypervisors and TDX hosts to the minimum required.
Exploitation
- No known exploitation as of 10 Nov 2026, according to third-party aggregators. CISA KEV was not checked.
- No public proof of concept or exploit found.
Our recommendation
- Check INTEL-SA-01580 for affected versions and fixes.
- If you use TDX hosts or confidential computing, ask your hosting or cloud provider whether their platforms are patched.
- Limit privileged hypervisor and TDX administrator rights.
- Apply Intel's MigTD updates together as a batch once they are released.
- Recheck NVD and CISA KEV once NVD analysis is complete.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Intel INTEL-SA-01580 advisory intel.com
- Strix CVE-2026-57893 details www.strix.ai
- OffSeq radar: CVE-2026-57893 (exploitation status) radar.offseq.com
- OffSeq radar: SPDM responder flaw (CVE-2026-57893) radar.offseq.com
- Intel TDX MigTD design guide cdrdv2-public.intel.com
- Intel TDX joint security review with Microsoft www.intel.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 10:46.
Original description (NVD)
Incomplete internal state distinction in the MigTD's SPDM responder for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable data corruption. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.