Enclave OS Virtual EUVD-2026-96018

Exploitation requires the attacker to already possess a valid enclave TLS private key (the explicit precondition in the description and the basis for CVSS AT:P/AC:H) and to occupy a position allowing them to terminate/relay a victim relying party's TLS connection. The flaw exists only in the TDX/GPU RA-TLS certificate issuer of Enclave OS Virtual before tdx-v0.2.43 and tdx-gpu-v0.6.27, where quote ReportData binds the certificate public-key hash and client nonce but omits any value tied to the active TLS session, permitting quote relay onto a different connection. Limiting factors: the required private-key compromise is a substantial barrier, and patched builds (which fold the TLS channel binder into ReportData so relayed quotes fail closed) are not affected; the fix path also depends on the Privasys/go fork that supplies the session channel binder.

This is a genuine high-severity design flaw (CVSS 4.0 base 9.1) in the RA-TLS attestation layer of a confidential-computing product (CWE-346, Origin Validation Error), but its real-world exploitability is gated by a demanding precondition. The CVSS vector AV:N/AC:H/AT:P/PR:N/UI:N is internally consistent with the description: it is network-reachable and needs no authentication against the target (PR:N), but carries AC:H plus AT:P (attack requirements present) because the attacker must first obtain a legitimate enclave TLS private key and occupy a relay/termination position. The VC:H/VI:H/VA:N impact matches a scenario where a relying party is deceived into trusting an attacker-terminated connection as the attested enclave, exposing and allowing manipulation of data meant only for the enclave, without an availability effect. No EPSS score, CISA KEV listing, or public POC was supplied in the intelligence set, and the fix was delivered quietly via a GitHub Security Advisory and commit rather than through active-exploitation reporting. The signals therefore point to a serious-but-conditional cryptographic/attestation weakness rather than a mass-exploited, low-effort flaw: the private-key-possession prerequisite makes this most relevant to targeted attacks against high-value confidential workloads, not opportunistic scanning. Note the high CVSS is driven by impact and network vector; the AC:H/AT:P metrics are the honest brake on raw urgency.

An attacker who has compromised or extracted the TLS private key of a legitimate enclave captures a genuine TDX/GPU attestation quote whose ReportData binds only the certificate public-key hash and client nonce, not the TLS session. They stand up their own TLS endpoint, terminate a victim relying party's connection themselves, and present the relayed genuine quote so the relying party accepts the attacker-controlled channel as the real attested enclave. No public exploit identified at time of analysis; exploitation requires high complexity (AC:H) and a specific attack requirement (AT:P) of prior private-key compromise.