Intel TDX MigTD: Information disclosure via uninitialized resource
Summary
The Intel TDX Migration Trust Domain (MigTD) component, used for live migration of confidential VMs, contains an uninitialized resource that may lead to information disclosure. An attacker needs high privileges and adjacent access to the system, and the impact is limited to low confidentiality loss. Intel rates the issue as medium (CVSS 4.0 base score 4.8) and published it in advisory INTEL-SA-01580.
Affected
- Intel TDX Migration Trust Domain (MigTD)
- Affected versions: Unknown. See Intel advisory INTEL-SA-01580.
Fixed in
Unknown. Check Intel advisory INTEL-SA-01580 for reference software updates.
Workaround
- No vendor-specific workaround confirmed.
- Restrict privileged access to TDX hosts and MigTD-related management.
Exploitation
- Not known to be exploited.
- Not listed in CISA KEV.
- No public proof of concept found.
Our recommendation
- Check with your hosting or cloud provider whether INTEL-SA-01580 updates have been applied.
- If you operate TDX hosts, identify the affected MigTD versions in the Intel advisory and apply the reference updates.
- Restrict privileged access to TDX hosts.
- The advisory covers several other MigTD CVEs published the same day, so patch the advisory as a whole.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Intel Security Advisory INTEL-SA-01580 intel.com
- Intel Security Center www.intel.com
- OpenCVE CVE-2026-60059 app.opencve.io
- OffSeq Threat Radar CVE-2026-60059 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:48.
Original description (NVD)
Use of uninitialized resource in the MigTD memory for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an information disclosure. Network adversary with a privileged user combined with a low complexity attack may enable data exposure. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.