Intel TDX MigTD CVE-2026-63027

Exploitation requires adjacent-network access (AV:A) to a host running the Intel TDX Migration Trust Domain (MigTD), the component that handles live migration of Trust Domains in Intel TDX confidential computing; the flaw lies in the get_tcb_level_by_svn routine. No authentication (PR:N) and no user interaction (UI:N) are needed, and no special attack requirement applies (AT:N), so default MigTD deployments are reachable by an on-fabric adversary. Limiting factors: the attacker must be positioned on the adjacent network/migration fabric rather than the open internet, the product is only present where Intel TDX with Trust Domain migration is deployed, and impact is restricted to availability (denial of service) with no data exposure or code execution. The precise trigger within get_tcb_level_by_svn is not described in the available sources beyond the CWE-696 incorrect-behavior-order classification.

Signals converge on a moderate, availability-only issue rather than a top priority. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) describes an adjacent-network, low-complexity, unauthenticated attack with no attack requirements and no user interaction, but impact is confined to availability (VA:L) with no confidentiality or integrity effect and no subsequent-system impact (SC/SI/SA:N), yielding a base score of 5.3 (Medium). The vuln.today decision label is 'this_month' - meaning remediate on a routine patch cycle, not emergency. There is no CISA KEV listing, no EPSS score supplied, and no public exploit or PoC reference in the input, so exploitation remains theoretical. The adjacent (AV:A) rather than network (AV:N) vector is a meaningful limiter: an attacker needs to be on the same logical adjacent network/fabric as the MigTD, not arbitrary internet reach. No signals conflict; the main gap is the absence of an EPSS probability and any confirmation of exploitability, so prioritization rests on severity and the vendor advisory alone.

An adversary with adjacent-network access to the migration fabric of an Intel TDX confidential-computing host sends crafted input that reaches the get_tcb_level_by_svn routine in MigTD, where an incorrect ordering of operations (CWE-696) can be driven to disrupt the Migration TD and deny service. No authentication or user interaction is required (PR:N/UI:N), and complexity is low (AC:L). No public exploit code or PoC reference is identified in the available data, so this is a plausible but unproven scenario.