Intel TDX MigTD CVE-2026-61887

Requires the target host to be running the Intel TDX Migration Trust Domain (MigTD) and performing (or reachable for) SPDM rebind during Trust Domain migration - the vulnerable step is the missing authentication check in the MigTD SPDM rebind implementation. The attacker needs ADJACENT network access (AV:A): a logically adjacent position such as the same migration network segment or an adjacent host path, not arbitrary Internet reach. Per the CVSS vector no authentication (PR:N), no user interaction (UI:N), and no special attack requirements (AT:N) are needed, and complexity is low (AC:L). The primary limiting factor is reachability: exploitation is constrained to adjacent access against hosts actively using TDX MigTD migration, which bounds real-world exposure despite the maximal impact metrics.

This is a genuine high-priority issue, not a high-CVSS/low-real-risk artifact, but its urgency rests on severity and vendor signaling rather than confirmed exploitation. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) describes an unauthenticated, low-complexity attack with no user interaction and no special attack requirements, and the impact is maximal - high confidentiality, integrity and availability on both the vulnerable MigTD system and subsequent systems (SC:H/SI:H/SA:H), consistent with a scope-changing compromise of a trust-domain migration component. CWE-304 (missing critical step in authentication) in the SPDM rebind path aligns with an authentication-bypass leading to escalation of privilege, information disclosure and potential RCE. Two tempering factors: the attack vector is ADJACENT (AV:A), not fully remote-over-Internet, so an attacker needs a logically adjacent position (same L2 segment / migration network / co-resident host path) rather than arbitrary Internet reach - the description's phrase 'Network adversary ... remote code execution ... potentially occur via adjacent access' conflates network and adjacent language, so treat reachability as adjacent-network, not open-Internet. EPSS is not provided, there is no CISA KEV listing, and no public exploit is referenced; the 'act_now' label is the vuln.today priority signal and the report originates from Intel, not from confirmed in-the-wild activity. Net: prioritize patching for any TDX-migration deployment, but recognize exploitation is currently theoretical and gated by adjacent access.

An attacker positioned on the migration/adjacent network path to a host running Intel TDX MigTD initiates or intercepts an SPDM rebind exchange and exploits the missing authentication step to impersonate a legitimate peer. Because no authentication, privileges, or user interaction are required and complexity is low, the attacker can escalate privilege, disclose Trust Domain data, and potentially achieve remote code execution within the MigTD context. No public exploit is identified at time of analysis, so this scenario is inferred from the CWE-304 authentication-bypass class and the CVSS adjacent/low-complexity metrics rather than from demonstrated exploit code.