Intel MigTD CVE-2026-62930

Requires adjacent-network access (AV:A) to a host running the Intel TDX Migration Trust Domain (MigTD), with the attacker able to reach MigTD's TLS implementation - relevant where TD live-migration is in use. Per the CVSS vector exploitation is unauthenticated (PR:N) with no user interaction (UI:N) and low attack complexity (AC:L/AT:N). The key limiting factor is that this is NOT remotely routable from the internet: the attacker must already sit on the same adjacent segment as the MigTD, which substantially constrains exposure. The exact fault that produces the DoS is not described in the available sources beyond the CWE-252 unchecked-return-value classification; impact is confined to integrity-low and availability-low of the MigTD with no subsequent-system effect.

This is a genuinely medium-severity, not an inflated high. The vendor CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) describes an adjacent-network, low-complexity, unauthenticated reach, but the impact is deliberately bounded: confidentiality none, integrity low, availability low, with no subsequent-system impact (SC/SI/SA all N), yielding a 5.3 Medium. The decision framework signals align with a measured response rather than an emergency: vuln.today priority is 'this_month', not act_now or emergency. No EPSS score, no CISA KEV listing, and no public PoC or exploit reference are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The one point of friction worth flagging is AV:A: this is an adjacent-access flaw in Intel TDX's Migration TD, not an internet-facing service, so real-world risk is gated by an attacker already having a foothold on the migration/network segment - materially narrowing exposure despite PR:N. The only confirmed source is the Intel advisory (INTEL-SA-01580); no independent corroboration is in the dataset.

An adversary with a position on the same (adjacent) network segment as a TDX host sends crafted TLS traffic to the MigTD during or around a Trust Domain migration; because a return value in MigTD's TLS handling is not checked, the condition leads to a denial of service against the Migration TD. No authentication and no user interaction are required (PR:N/UI:N). No public PoC or exploit code is referenced in the available sources.