{"id":"CVE-2026-61473","kind":"vulnerability","aliases":["CVE-2026-61473"],"related":[],"title":"Intel TDX MigTD: capture-replay bypass lets a privileged local attacker escalate","description":"Authentication bypass by capture-replay in the MigTD for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts.","summary":"Authentication bypass by capture-replay in the Intel TDX Migration TD (MigTD) reference software. Intel says a privileged system-software attacker with local access could use it to escalate privilege, with high confidentiality and integrity impact (CVSS 4.0 9.2). Fixed in MigTD 0.7.2.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"MigTD","fixed":["0.7.2"],"affected":"< 0.7.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["confidential-computing","hypervisor","infrastructure","intel-tdx","migtd"],"not_affected_if":["no-td-migration","no-tdx-migration","non-tdx"],"how_to_check":"Check the MigTD build you deploy (intel/MigTD reference software, or the MigTD binary your platform/cloud vendor ships): any version before 0.7.2 is affected. Ask your cloud or platform vendor whether their MigTD is built from 0.7.2 or later.","fix":"Update MigTD to version 0.7.2 or later (intel/MigTD v0.7.2 release).","status":"open","published_at":"2026-11-10T18:17:44+00:00","first_seen_at":"2026-11-10T18:23:00+00:00","triaged_at":"2026-11-10T18:24:15+00:00","updated_at":"2026-11-10T18:25:14+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-10T18:24:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Intel TDX MigTD: capture-replay bypass lets a privileged local attacker escalate","impact":"high","summary":"The Intel TDX Migration Trust Domain (MigTD) component has an authentication bypass that allows replay of captured messages. A privileged local system software attacker can use it to escalate privileges and affect confidentiality and integrity.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["intel-tdx","hypervisor","confidential-computing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker escalates privileges and reads or alters confidential system data","analyst_note":"Find Intel's security advisory and the affected MigTD versions and fixed releases; the NVD entry alone gives no product ranges.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-tdx-migration"],"who_is_affected":"Affects hosts running Intel TDX with the MigTD migration trust domain inside Ring 0 hypervisor environments. Exposure depends on whether live migration of TDX trust domains is in use. The sources do not give affected versions or a fix.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000704,"input_tokens":4679,"output_tokens":472,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Intel's security advisory and the affected MigTD versions and fixed releases; the NVD entry alone gives no product ranges.","search":"'-2026':15A,18A '-61473':16A,19A '0':95C '0.7.2':74B '4.0':69B '9.2':70B 'access':55B,128C 'adversari':105C 'allow':98C 'attack':12A,52B,115C,130C 'authent':30B,75C 'avail':155C,170C 'bypass':7A,31B,76C 'captur':5A,34B,79C 'capture-replay':4A,33B,78C 'combin':110C 'complex':114C 'comput':23B 'confidenti':22B,64B,150C,165C 'confidential-comput':21B 'could':56B 'cve':14A,17A 'cvss':68B 'domain':91C 'enabl':117C 'escal':13A,60B,100C,118C 'fix':71B 'high':63B,151C,153C,166C,168C 'hypervisor':24B,96C 'impact':67B,148C,172C 'infrastructur':25B 'integr':66B,152C,167C 'intel':1A,27B,38B,45B,86C 'intel-tdx':26B 'interact':143C 'intern':137C 'knowledg':138C 'let':8A 'local':11A,54B,127C 'low':113C 'may':97C,116C,123C,147C 'migrat':40B,89C 'migtd':3A,20A,29B,42B,73B,83C,92C 'none':156C,171C 'occur':125C 'potenti':124C,145C 'present':134C 'privileg':10A,48B,61B,102C,108C,120C 'r':87C 'refer':43B 'replay':6A,35B,80C 'requir':131C,140C 'result':122C,161C 'ring':94C 'say':46B 'softwar':44B,51B,104C 'special':136C 'subsequ':163C 'system':50B,103C,160C,164C 'system-softwar':49B 'td':41B 'tdx':2A,28B,39B,88C 'trust':90C 'use':57B 'user':109C,142C 'via':126C 'vulner':146C,159C 'within':93C 'without':135C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Intel TDX live migration of confidential VMs with MigTD built from Intel's reference software before 0.7.2: mainly cloud and hypervisor operators and confidential-computing platforms. The attacker must be privileged system software (e.g. the host hypervisor) with local access. Teams not using TDX or TD migration can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T18:25:14Z","by":"analyst","doc":"https://github.com/intel/MigTD/releases","run_id":2485},"products":{"at":"2026-11-10T18:25:14Z","by":"analyst","doc":"https://github.com/intel/MigTD/releases","run_id":2485},"how_to_check":{"at":"2026-11-10T18:25:14Z","by":"analyst","doc":"https://github.com/intel/MigTD/releases","run_id":2485},"who_affected":{"at":"2026-11-10T18:25:14Z","by":"analyst","doc":"https://github.com/intel/MigTD/releases","run_id":2485}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["migtd"],"ptokens":["migtd"],"labels":["confidentialcomputing","critical","hypervisor","infrastructure","inteltdx","migtd"],"campaign_type":null,"search_a":"'-2026':15A,18A '-61473':16A,19A 'attack':12A 'bypass':7A 'captur':5A 'capture-replay':4A 'cve':14A,17A 'escal':13A 'intel':1A 'let':8A 'local':11A 'migtd':3A,20A 'privileg':10A 'replay':6A 'tdx':2A","search_b":"'0.7.2':74B '4.0':69B '9.2':70B 'access':55B 'attack':52B 'authent':30B 'bypass':31B 'captur':34B 'capture-replay':33B 'comput':23B 'confidenti':22B,64B 'confidential-comput':21B 'could':56B 'cvss':68B 'escal':60B 'fix':71B 'high':63B 'hypervisor':24B 'impact':67B 'infrastructur':25B 'integr':66B 'intel':27B,38B,45B 'intel-tdx':26B 'local':54B 'migrat':40B 'migtd':29B,42B,73B 'privileg':48B,61B 'refer':43B 'replay':35B 'say':46B 'softwar':44B,51B 'system':50B 'system-softwar':49B 'td':41B 'tdx':28B,39B 'use':57B","search_c":"'0':95C 'access':128C 'adversari':105C 'allow':98C 'attack':115C,130C 'authent':75C 'avail':155C,170C 'bypass':76C 'captur':79C 'capture-replay':78C 'combin':110C 'complex':114C 'confidenti':150C,165C 'domain':91C 'enabl':117C 'escal':100C,118C 'high':151C,153C,166C,168C 'hypervisor':96C 'impact':148C,172C 'integr':152C,167C 'intel':86C 'interact':143C 'intern':137C 'knowledg':138C 'local':127C 'low':113C 'may':97C,116C,123C,147C 'migrat':89C 'migtd':83C,92C 'none':156C,171C 'occur':125C 'potenti':124C,145C 'present':134C 'privileg':102C,108C,120C 'r':87C 'replay':80C 'requir':131C,140C 'result':122C,161C 'ring':94C 'softwar':104C 'special':136C 'subsequ':163C 'system':103C,160C,164C 'tdx':88C 'trust':90C 'user':109C,142C 'via':126C 'vulner':146C,159C 'within':93C 'without':135C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T18:17:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"secure@intel.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61473","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61473","severity":null,"published_at":"2026-11-10T18:17:44+00:00","modified_at":"2026-11-10T18:17:44+00:00","first_seen_at":"2026-11-10T18:23:00+00:00","fetched_at":"2026-11-10T18:23:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-61473:2485","url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html","severity":null,"published_at":"2026-11-10T18:25:14+00:00","modified_at":"2026-11-10T18:25:14+00:00","first_seen_at":"2026-11-10T18:25:14+00:00","fetched_at":"2026-11-10T18:25:14+00:00","note":"Intel INTEL-SA-01580 (11/10/2026): all MigTD reference software before 0.7.2 affected; fix 0.7.2+ (GitHub release). Advisory rates this CVE CVSS4 9.2, no workarounds section; found internally by Intel. Exploitation/PoC and social chatter not searched.","cites":["https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html","https://github.com/intel/MigTD/releases"]}],"documents":[{"id":117041,"url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html","title":"INTEL-SA-01580 Intel TDX Migration Trust Domain (MigTD) Advisory","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":117047,"url":"https://github.com/intel/MigTD/releases","title":"intel/MigTD releases (v0.7.2)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}