Enclave OS Mini EUVD-2026-95996

Exploitation requires ALL of: (1) the attacker already possesses a valid enclave RA-TLS private key (a prior key-compromise, reflected by CVSS AT:P); (2) the RA-TLS deployment is using challenge-response mode - the patch notes deterministic/cached-quote mode is fully verified in the cert-verifier callback and is unaffected; (3) a running version prior to wasm-v0.40.0; and (4) the attacker can relay the genuine quote and terminate the TLS connection (MITM positioning). The limiting factors are significant: without the stolen private key the quote cannot be presented at all, and challenge mode is the only vulnerable path, so defenders not using challenge-mode RA-TLS or already on wasm-v0.40.0+ are not exposed.

The CVSS 4.0 base score of 9.1 (Critical) is driven by network reach (AV:N), no privileges or user interaction (PR:N/UI:N) and high confidentiality and integrity impact (VC:H/VI:H), but it is meaningfully tempered by two metrics the raw number obscures: AC:H and AT:P. The vulnerability is only exploitable by an attacker who has ALREADY obtained a valid enclave TLS private key - a substantial prerequisite that implies a prior, separate compromise of the enclave's key material - and additionally requires the attacker to be positioned to relay and terminate a TLS connection. This is therefore a high-barrier, targeted attack rather than an opportunistic internet-wide one. No EPSS score was provided in the input, there is no CISA KEV listing (not present in input), and no public exploit code is referenced (no POC in input), so there is no public exploit identified at time of analysis. The signals are internally consistent - a high nominal severity paired with explicit attack-requirement/complexity penalties and the absence of exploitation evidence - pointing to a genuine but conditional attestation-integrity flaw rather than a mass-exploitation emergency. Net: treat as a real priority for anyone running Enclave OS Mini in a confidential-computing trust chain, but the stolen-private-key precondition and niche footprint place it below unauthenticated-RCE-class threats.

An attacker who has separately obtained an enclave's RA-TLS private key positions themselves as a man-in-the-middle and relays a genuine, correctly-formed SGX/TDX quote (whose ReportData binds only the cert public-key hash and client nonce) onto a connection they themselves terminate. Because the pre-fix challenge-mode path never bound the quote to the live TLS session, the relying party accepts the attacker-controlled connection as the authentic attested enclave and discloses or trusts data accordingly. No public exploit code is referenced, and CVSS AC:H/AT:P indicate the attack requires both key compromise and MITM relay positioning.