Intel TDX MigTD CVE-2026-61473

Exploitation requires a 'system software adversary with a privileged user' - i.e. a high-privilege / Ring 0 hypervisor position (PR:H) - and local access (AV:L); it is not remotely or unauthenticated-triggerable. The affected feature must be in use: the Intel TDX Migration Trust Domain (MigTD) component performing Trust Domain live migration must be deployed and active. As a capture-replay bypass (CWE-294), the attacker must be positioned to capture a legitimate migration-authentication exchange and then replay it; no user interaction is needed (UI:N) and no special internal knowledge is required (AT:N, AC:L). Limiting factors for defenders: the high-privilege precondition and local-only vector substantially shrink the realistic attacker set, and only environments running TDX confidential-computing migration are exposed - hosts without TDX or without MigTD-based migration are not affected.

This is a genuine high-priority issue, corroborated across multiple signals rather than resting on a single inflated score. The vendor-supplied CVSS 4.0 vector (CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N, 9.2) describes a local, low-complexity attack that requires high privileges (PR:H) and no user interaction, with high confidentiality and integrity impact to both the vulnerable system and a subsequent system (the scope-crossing SC:H/SI:H that pushes the score into the 9.x range). The vuln.today Decision label is act_now and the source is Intel itself (first-party vendor reporting), which raises confidence in the technical details. Countervailing the raw 9.2: exploitation is NOT remote and NOT unauthenticated - it presupposes a 'system software adversary with a privileged user,' i.e. an attacker already operating at Ring 0 / hypervisor level, so this is primarily a trust-boundary / confidential-computing isolation breach rather than an initial-access vector. No EPSS score, no CISA KEV entry, and no public PoC were supplied, so there is no evidence of in-the-wild or widespread exploitation; the urgency here derives from the act_now decision and the severity of a TDX attestation bypass, not from observed activity. Net: treat as a priority patch for environments actually running Intel TDX live migration, but note the high-privilege precondition meaningfully narrows the realistic attacker set.

An adversary who already controls the host hypervisor (Ring 0 system software) observes and captures a MigTD migration-authentication exchange, then replays the captured material to impersonate a legitimate party and defeat the capture-replay-vulnerable authentication (CWE-294). Because the CVSS vector is local with low attack complexity and no user interaction, the replay succeeds without special internal knowledge, letting the attacker escalate privilege and compromise the confidentiality and integrity of the migrating Trust Domain and the subsequent system. No public exploit identified at time of analysis.