Intel MigTD: Authentication bypass by capture-replay enables privilege escalation
Summary
The Intel TDX Migration Trust Domain (MigTD) component contains an authentication bypass caused by capture-replay (CWE-294). A local attacker with high privileges on the system, such as a privileged user or system software, can use it to escalate privileges from Ring 0 and affect confidentiality and integrity. The CVSS vector requires local access, high privileges and no user interaction, and the attack has low complexity. The official advisory and the affected versions could not be verified at the time of writing.
Affected
- Intel(R) TDX Migration Trust Domain (MigTD), versions not confirmed.
- The CVE record lists the product as affected, with details in the Intel references. The exact version ranges are unknown.
Fixed in
Unknown. Intel reference software updates are expected according to the advisory, but the fixed versions have not been verified.
Workaround
Unknown. No mitigation guidance has been found.
Exploitation
Unknown. No exploitation in the wild, public proof of concept or CISA KEV entry has been found so far. This is not proof that none exists, as the CVE was published recently.
Our recommendation
- Open Intel advisory INTEL-SA-01580 and record the affected and fixed MigTD versions.
- Check whether you operate TDX hosts that use MigTD for live migration of confidential VMs. Most SMEs are unlikely to be affected.
- If you do, confirm with your cloud or hardware provider whether the fix has been applied, and apply reference software updates as soon as they are available.
- Monitor NVD and CISA KEV for updated enrichment and exploitation status.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Intel advisory INTEL-SA-01580 intel.com
- Intel MigTD GitHub repository github.com
- MigTD GitHub releases github.com
- Intel processors affected consolidated product CPU model list www.intel.com
- Intel Security Center www.intel.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 19:22.
Original description (NVD)
Authentication bypass by capture-replay in the MigTD for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.