Intel TDX MigTD CVE-2026-44685

Exploitation requires the Intel TDX Migration Trust Domain (MigTD) component to be in use - i.e. a deployment that performs live migration of TDX Trust Domains - and specifically the MigTD rebinding protocol path. The attacker must already be a privileged system-software adversary operating at Ring 0 (a malicious or compromised hypervisor) with a privileged user and local access to the platform (AV:L, PR:H); it is not remotely or unauthenticatedly exploitable. No user interaction is required (UI:N) and no special attack requirements apply (AT:N), and the attack complexity is low (AC:L), so once the privileged-local and MigTD-migration preconditions are met, triggering is straightforward. The limiting factors are therefore the need for pre-existing high privilege and the presence of TDX TD-migration/MigTD functionality; platforms not using TDX migration are not exposed.

This is a genuinely high-priority issue, though its real-world reach is bounded by its preconditions. The CVSS 4.0 vector (9.3, AV:L/AC:L/AT:N/PR:H/UI:N) describes a locally-exploitable authentication bypass that requires the attacker to already hold high privileges (PR:H) - explicitly a 'system software adversary with a privileged user,' i.e. a malicious or compromised hypervisor at Ring 0. It is not remotely reachable and not unauthenticated, so this is not a mass-internet-exploitable bug; it is a confidential-computing trust-boundary break where the hypervisor is assumed hostile. Within that threat model it is severe: the spoofing weakness (CWE-290) in the MigTD rebinding protocol defeats the very isolation Intel TDX is meant to provide, with high confidentiality, integrity and availability impact on both the vulnerable system and subsequent systems (SC:H/SI:H/SA:H - a scope change into migrated Trust Domains). The vuln.today decision label is act_now and the finding is vendor-reported (Intel SA-01580), which drives urgency. However, signal coverage is incomplete: no EPSS score, no CISA KEV listing, and no public exploit were provided, so exploitation is currently theoretical/vendor-disclosed rather than observed. The low-attack-complexity, privileged-local profile fits a targeted cloud/CSP tenant-isolation attack rather than opportunistic widespread exploitation.

A system-software adversary controlling the hypervisor (Ring 0) abuses the MigTD rebinding protocol's authentication-bypass-by-spoofing weakness to impersonate a legitimate migration peer during a Trust Domain live-migration exchange. By spoofing the rebinding, the attacker escalates privilege and achieves local code execution in the MigTD context, breaking the confidentiality and integrity isolation that TDX is supposed to guarantee for a migrated Trust Domain. No public exploit identified at time of analysis; the attack requires the attacker to already be a privileged local actor.