{"id":"CVE-2026-61887","kind":"vulnerability","aliases":["CVE-2026-61887"],"related":[],"title":"Intel TDX MigTD: missing authentication step lets attackers escalate privileges","description":"Missing critical step in authentication in the MigTD SPDM rebind implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege and information disclosure. Network adversary with an unauthenticated user combined with a low complexity attack may enable remote code execution. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (high) impacts.","summary":"The MigTD SPDM rebind implementation in Intel's TDX Migration Trust Domain skips a required authentication step. A network attacker without an account could potentially escalate privileges, read information, or run code on the affected system.","severity":"critical","cvss":9.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Intel TDX Migration Trust Domain (MigTD)","fixed":["0.7.2"],"affected":"< 0.7.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["confidential-computing","hypervisor","infrastructure","intel-tdx","migtd"],"not_affected_if":["no-intel-tdx","no-migtd"],"how_to_check":"Check the MigTD build/version you deploy (the MigTD binary or reference-software release your platform vendor ships). Any version before 0.7.2 is affected. Also check your hypervisor/cloud vendor's firmware notes if MigTD is bundled.","fix":"Update Intel TDX Migration Trust Domain (MigTD) reference software to version 0.7.2 or later (GitHub release v0.7.2), per INTEL-SA-01580.","status":"open","published_at":"2026-11-10T18:17:44+00:00","first_seen_at":"2026-11-10T18:23:00+00:00","triaged_at":"2026-11-10T18:24:14+00:00","updated_at":"2026-11-10T18:24:50+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-10T18:24:14Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Intel TDX MigTD: missing authentication step lets attackers escalate privileges","impact":"high","summary":"The MigTD SPDM rebind implementation in Intel's TDX Migration Trust Domain skips a required authentication step. A network attacker without an account could potentially escalate privileges, read information, or run code on the affected system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["intel-tdx","confidential-computing","hypervisor"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker gains hypervisor-level privilege, reads data, executes code remotely","analyst_note":"Find Intel's security advisory for CVE-2026-61887 to confirm affected MigTD versions, the fixed version, and any mitigation.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-intel-tdx","no-migtd"],"who_is_affected":"Affects Intel TDX deployments that use the MigTD live-migration trust domain with SPDM rebind. The sources do not say which versions or configurations are vulnerable, so the exposed set is unknown. Teams not running Intel TDX with MigTD can likely skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000714,"input_tokens":4690,"output_tokens":490,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Intel's security advisory for CVE-2026-61887 to confirm affected MigTD versions, the fixed version, and any mitigation.","search":"'-2026':12A,15A '-61887':13A,16A '0':90C 'access':125C 'account':54B 'adjac':124C 'adversari':102C 'affect':66B 'allow':93C 'attack':8A,51B,112C,127C 'authent':5A,47B,72C 'avail':152C,167C 'code':63B,116C 'combin':107C 'complex':111C 'comput':25B 'confidenti':24B,147C,162C 'confidential-comput':23B 'could':55B 'critic':69C 'cve':11A,14A 'disclosur':100C 'domain':21A,43B,86C 'enabl':114C 'escal':9A,57B,95C 'execut':117C 'high':148C,150C,153C,163C,165C,168C 'hypervisor':26B,91C 'impact':145C,169C 'implement':36B,78C 'inform':60B,99C 'infrastructur':27B 'integr':149C,164C 'intel':1A,17A,29B,38B,81C 'intel-tdx':28B 'interact':140C 'intern':134C 'knowledg':135C 'let':7A 'low':110C 'may':92C,113C,120C,144C 'migrat':41B,84C 'migration':19A 'migtd':3A,22A,31B,33B,75C,87C 'miss':4A,68C 'network':50B,101C 'occur':122C 'potenti':56B,121C,142C 'present':131C 'privileg':10A,58B,97C 'r':82C 'read':59B 'rebind':35B,77C 'remot':115C 'requir':46B,128C,137C 'result':119C,158C 'ring':89C 'run':62B 'skip':44B 'spdm':34B,76C 'special':133C 'step':6A,48B,70C 'subsequ':160C 'system':67B,157C,161C 'tdx':2A,18A,30B,40B,83C 'trust':20A,42B,85C 'unauthent':105C 'user':106C,139C 'via':123C 'vulner':143C,156C 'within':88C 'without':52B,132C","nicknames":[],"mitigations":[],"who_affected":"Affects Intel TDX deployments that run the MigTD (Migration Trust Domain) reference software before version 0.7.2, which is used for live migration of trust domains. Intel rates the flaw critical (CVSS 4.0 9.4): an unauthenticated attacker with adjacent network access could escalate privilege and possibly run code. Teams not using Intel TDX or MigTD live migration can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T18:24:50Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html","run_id":2484},"products":{"at":"2026-11-10T18:24:50Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html","run_id":2484},"how_to_check":{"at":"2026-11-10T18:24:50Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html","run_id":2484},"who_affected":{"at":"2026-11-10T18:24:50Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html","run_id":2484}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["inteltdxmigrationtrustdomainmigtd","tdxmigrationtrustdomainmigtd"],"ptokens":["domain","intel","migration","migtd","tdx","trust"],"labels":["confidentialcomputing","critical","hypervisor","infrastructure","inteltdx","migtd"],"campaign_type":null,"search_a":"'-2026':12A,15A '-61887':13A,16A 'attack':8A 'authent':5A 'cve':11A,14A 'domain':21A 'escal':9A 'intel':1A,17A 'let':7A 'migration':19A 'migtd':3A,22A 'miss':4A 'privileg':10A 'step':6A 'tdx':2A,18A 'trust':20A","search_b":"'account':54B 'affect':66B 'attack':51B 'authent':47B 'code':63B 'comput':25B 'confidenti':24B 'confidential-comput':23B 'could':55B 'domain':43B 'escal':57B 'hypervisor':26B 'implement':36B 'inform':60B 'infrastructur':27B 'intel':29B,38B 'intel-tdx':28B 'migrat':41B 'migtd':31B,33B 'network':50B 'potenti':56B 'privileg':58B 'read':59B 'rebind':35B 'requir':46B 'run':62B 'skip':44B 'spdm':34B 'step':48B 'system':67B 'tdx':30B,40B 'trust':42B 'without':52B","search_c":"'0':90C 'access':125C 'adjac':124C 'adversari':102C 'allow':93C 'attack':112C,127C 'authent':72C 'avail':152C,167C 'code':116C 'combin':107C 'complex':111C 'confidenti':147C,162C 'critic':69C 'disclosur':100C 'domain':86C 'enabl':114C 'escal':95C 'execut':117C 'high':148C,150C,153C,163C,165C,168C 'hypervisor':91C 'impact':145C,169C 'implement':78C 'inform':99C 'integr':149C,164C 'intel':81C 'interact':140C 'intern':134C 'knowledg':135C 'low':110C 'may':92C,113C,120C,144C 'migrat':84C 'migtd':75C,87C 'miss':68C 'network':101C 'occur':122C 'potenti':121C,142C 'present':131C 'privileg':97C 'r':82C 'rebind':77C 'remot':115C 'requir':128C,137C 'result':119C,158C 'ring':89C 'spdm':76C 'special':133C 'step':70C 'subsequ':160C 'system':157C,161C 'tdx':83C 'trust':85C 'unauthent':105C 'user':106C,139C 'via':123C 'vulner':143C,156C 'within':88C 'without':132C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T18:17:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"secure@intel.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61887","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61887","severity":null,"published_at":"2026-11-10T18:17:44+00:00","modified_at":"2026-11-10T18:17:44+00:00","first_seen_at":"2026-11-10T18:23:00+00:00","fetched_at":"2026-11-10T18:23:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-61887:2484","url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html","severity":null,"published_at":"2026-11-10T18:24:50+00:00","modified_at":"2026-11-10T18:24:50+00:00","first_seen_at":"2026-11-10T18:24:50+00:00","fetched_at":"2026-11-10T18:24:50+00:00","note":"Read Intel INTEL-SA-01580 (primary): all MigTD reference software before 0.7.2 affected, fixed in 0.7.2; Intel lists no workarounds. Advisory rates overall MEDIUM but this CVE is CVSS4 9.4 (AV:A/PR:N). No exploitation or PoC seen; no social search done. Advisory page was truncated in web-cli; read via WebFetch.","cites":["https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"]}],"documents":[{"id":117041,"url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html","title":"INTEL-SA-01580 Intel TDX Migration Trust Domain (MigTD) Advisory","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}