Intel TDX MigTD: Denial of service via incorrect behavior order
Summary
A flaw in the get_tcb_level_by_svn function of Intel's TDX Migration Trust Domain (MigTD) component may allow a denial of service. MigTD runs in Ring 0 within Intel TDX confidential-computing environments and handles migration of trust domains between hosts. According to the CNA data, an attacker with adjacent network access and no user interaction could reduce availability, without confidentiality or integrity impact.
Affected
- Intel(R) TDX Migration Trust Domain (MigTD)
- Exact affected versions: Unknown. See Intel advisory INTEL-SA-01580.
Fixed in
Unknown. See Intel advisory INTEL-SA-01580 and updates from your cloud or server vendor.
Workaround
Unknown. No mitigation has been published in the sources reviewed.
Exploitation
- Not listed in CISA KEV.
- EPSS below 1%.
- No public proof of concept or exploitation in the wild found at the time of research.
Our recommendation
- Check whether any hosts or cloud services use Intel TDX with MigTD.
- If yes, review Intel advisory INTEL-SA-01580 and apply firmware or module updates from your vendor as soon as available.
- If no, no action beyond routine patching is needed.
- Ask your hosting provider whether TDX with MigTD is used.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Intel advisory INTEL-SA-01580 intel.com
- OpenCVE CVE-2026-63027 app.opencve.io
- Strix CVE-2026-63027 www.strix.ai
- OffSeq threat entry radar.offseq.com
- Intel security center www.intel.com
- GitHub intel/MigTD pull request 1032 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:37.
Original description (NVD)
Incorrect behavior order in the get_tcb_level_by_svn for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.