Intel MigTD CVE-2026-60139

Requires adjacent network access to the MigTD SPDM transport channel used during Intel TDX Trust Domain migration (AV:A - not routable internet-wide), and per AT:P a specific attack requirement must be present for the condition to trigger (the exact requirement is not described in the available sources). No authentication is needed (PR:N) and no user interaction is required (UI:N). Limiting factors for defenders: the attacker must already be on the relevant adjacent segment, an active or reachable SPDM migration transport must be present, and the host must be an Intel TDX platform with MigTD deployed; impact is availability-only and does not propagate to subsequent systems (SC:N/SI:N/SA:N).

This is a medium-severity, defense-in-depth availability issue, not a top-tier emergency. The CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:N/UI:N) describes an adjacent, low-complexity, unauthenticated attack whose impact is confined to availability (VA:H) with low integrity impact (VI:L) and no confidentiality impact - and critically, no subsequent-system impact (SC:N/SI:N/SA:N), meaning the blast radius stays within the MigTD component rather than cascading to the broader TDX platform. The AT:P metric signals that a specific attack requirement must be present, so exploitation is conditional rather than always-on. The vuln.today decision label is 'this_month' (not act_now/emergency), which is consistent with a patch-on-normal-cadence posture. No EPSS score, no CISA KEV listing, and no verified public exploit were provided, so there is no evidence of active or imminent exploitation. The adjacency requirement (not internet-remote) further narrows realistic exposure to attackers already on the relevant network segment during a TD migration. Net: a legitimate but non-urgent priority - real because it is unauthenticated and low-complexity against a trust-domain component, but bounded by adjacent access, a conditional attack requirement, and availability-only, non-propagating impact.

An attacker positioned on the adjacent network segment used for Intel TDX trust-domain migration sends crafted SPDM transport messages to the MigTD endpoint, where improper neutralization (CWE-707) of the input causes a denial of service that disrupts the migration trust domain's availability. No authentication or user interaction is required, but the attacker must already have adjacent network access and a relevant attack requirement must be present. No public proof-of-concept or exploit code was identified in the provided sources.