Intel TDX MigTD: Denial of service in SPDM transport
Summary
The MigTD component of Intel TDX Migration Trust Domain, which handles secure session setup for migrating confidential VMs, contains improper neutralization in its SPDM transport. An attacker on the same logical network path as the migration service, without authentication, may cause a denial of service in the trust domain. Attack requirements are present, so exploitation is not trivial, and no user interaction is needed.
Affected
- Intel(R) TDX Migration Trust Domain (MigTD): affected versions unknown, see Intel advisory INTEL-SA-01580
- Vendor default: unaffected unless listed in the advisory
Fixed in
Unknown. Check the version table in Intel advisory INTEL-SA-01580.
Workaround
Unknown. No vendor-published workaround was found.
Exploitation
- Not known to be exploited.
- No public proof-of-concept found as of 10 November 2026.
Our recommendation
- Check whether you run Intel TDX confidential VMs with live migration; if not, record the CVE as not applicable.
- If you do, ask your cloud or hardware provider for their patch timeline for INTEL-SA-01580 and confirm that migration traffic is isolated to trusted endpoints.
- Apply the vendor's MigTD and TDX module updates once they are published and verified in the advisory.
- Monitor the advisory and NVD (status Awaiting Analysis) for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Intel advisory INTEL-SA-01580 intel.com
- Intel Security Center www.intel.com
- Intel TDX joint security review with Microsoft www.intel.com
- OffSeq Radar: CVE-2026-60139 radar.offseq.com
- Strix: CVE-2026-60139 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:51.
Original description (NVD)
Improper neutralization in the MigTD SPDM transport for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.