Intel TDX MigTD CVE-2026-61468

Exploitation requires the attacker to already be privileged system software operating at Ring 0 (the hypervisor/VMM) with a privileged user context, and to have local access to the host running the Intel TDX Migration Trust Domain (MigTD); per the CVSS vector this is PR:H, AV:L, UI:N with low complexity. The specific trigger is improper privilege management in the MigTD logging path, which may expose confidential trust-domain data; the precise logging operation or configuration that reveals the data is not detailed in the available sources. Limiting factors: the requirement for pre-existing high privilege and local access confines realistic exploitation to a compromised or malicious hypervisor operator, and impact is confined to confidentiality (no integrity or availability effect, no scope change to subsequent systems).

This is a medium-severity, low-urgency issue that does not warrant emergency response. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N) scores 6.7 and is internally consistent with the description: exploitation requires local access (AV:L) and high existing privileges (PR:H) - a 'system software adversary with a privileged user,' i.e. the hypervisor/VMM operator - with low attack complexity and no user interaction, yielding a confidentiality-only impact (VC:H, no integrity or availability effect). The PR:H requirement is the dominant mitigating factor: the attacker must already be privileged system software in Ring 0 (the hypervisor), so this is primarily a trust-boundary/privilege-management weakness (CWE-269) where privileged logging may expose protected MigTD data rather than a remotely reachable flaw. No EPSS score, no CISA KEV listing, and no POC are present in the supplied data, and the vuln.today decision label is 'this_month' (routine patch cadence) rather than act_now or emergency - all signals agree this is not under active exploitation. The reporter is Intel itself (coordinated disclosure via advisory INTEL-SA-01580), consistent with an internally-found issue, not a widely-weaponized one.

A malicious or compromised hypervisor/VMM operator with Ring 0 privileges on the host interacts with the MigTD logging mechanism and reads confidential information that the migration trust domain should have protected, breaking the TDX confidentiality guarantee for the migrated/attested data. The attack needs local access and pre-existing high privilege, so it is realistically limited to an already-privileged system-software adversary rather than a remote or unprivileged attacker. No public exploit identified at time of analysis.