---
id: "CVE-2026-44685"
page: "https://infrastack.ai/live/CVE-2026-44685"
kind: "vulnerability"
aliases: ["CVE-2026-44685"]
title: "Intel TDX MigTD: rebinding protocol spoof lets privileged code escalate to host"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "MigTD", "fixed": ["0.7.2"], "affected": "< 0.7.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["confidential-computing", "hypervisor", "infrastructure", "intel-tdx", "migtd", "self-hosted"]
not_affected_if: ["managed-hosting", "no-td-migration", "no-tdx-migration", "standard-virtualization"]
published_at: "2026-11-10T18:17:40+00:00"
first_seen_at: "2026-11-10T18:22:58+00:00"
updated_at: "2026-11-10T18:25:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44685", "first_seen_at": "2026-11-10T18:22:58+00:00"}, {"source": "analyst", "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html", "first_seen_at": "2026-11-10T18:25:02+00:00", "cites": ["https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html", "https://github.com/intel/MigTD/releases/tag/v0.7.2"]}]
exploit_sources: []
---

# Intel TDX MigTD: rebinding protocol spoof lets privileged code escalate to host

Link for people: https://infrastack.ai/live/CVE-2026-44685 (this .md is for agents)

Intel's MigTD component, which moves confidential virtual machines between hosts under Intel TDX, has an authentication bypass in its rebinding protocol caused by spoofing. A privileged system-software attacker with local access can use it to run code at ring 0 and gain full confidentiality, integrity and availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:MigTD affected < 0.7.2 fixed 0.7.2

## How to check

Check the MigTD version/build your TDX live-migration stack uses; any MigTD reference software older than 0.7.2 is affected. Cloud users: ask your provider whether it has moved to MigTD 0.7.2 or later.

## Fix

Update Intel MigTD reference software to 0.7.2 or later (https://github.com/intel/MigTD/releases/tag/v0.7.2)

## Timeline

- 2026-11-10T18:22:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-44685
- 2026-11-10T18:25:02+00:00 analyst https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html — Read Intel INTEL-SA-01580 (released 2026-11-10): CVE-2026-44685 CVSS4 9.3, local, privileged system-software attacker; all MigTD reference software before 0.7.2 affected; fix 0.7.2 (GitHub release linked, not opened by me). Advisory lists no workarounds. No exploitation or PoC stated; did not search social. how_to_check and who_affected are my wording, not verified.

## Documents

- [advisory] INTEL-SA-01580 Intel TDX Migration Trust Domain (MigTD) Advisory https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html
- [fix] intel/MigTD v0.7.2 https://github.com/intel/MigTD/releases/tag/v0.7.2

## From the sources

Authentication bypass by spoofing in the MigTD rebinding protocol for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_