Intel and AMD November 2026 Patch Tuesday: 200+ vulnerabilities incl. critical TDX MigTD flaws (CVE-2026-61887, CVE-2026-44685, CVE-2026-61473)

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5745 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Intel TDX MigTD SPDM Rebind Authentication Anomalies (INTEL-SA-01580, CVE-2026-61887/44685/61473)

Behaviour-first hunt for exploitation of the critical Intel TDX MigTD authentication flaws in INTEL-SA-01580 (migtd < 0.7.2): a missing authentication step in the SPDM rebind (CVE-2026-61887), spoofing of the rebinding protocol (CVE-2026-44685) and capture-replay of the authentication exchange (CVE-2026-61473). Aggregates MigTD/SPDM log lines per host in 15-minute windows and alerts when rebind activity coincides with skipped authentication steps, replayed or stale sessions, repeated authentication failures, or an unusual number of distinct peers. No public PoC or in-the-wild exploitation is reported, so this is an early-warning detection for confidential-computing live-migration hosts.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1210, T1557, T1211
• Data sources: linux_syslog, journald, intel_tdx_migtd_logs
• Severity: high
• Confidence: medium

Splunk SPL

index=linux (sourcetype=syslog OR sourcetype=journald) earliest=-24h "migtd" ("SPDM" OR "rebind")
| eval event_text=lower(_raw)
| rex field=_raw "(?<peer_ip>[0-9]{1,3}(?:[.][0-9]{1,3}){3})"
| eval rebind=if(match(event_text, "rebind"),1,0), auth_failure=if(match(event_text, "(auth(entication)?[ _-]?(fail|error|mismatch)|nonce[ _-]?(reuse|replay|mismatch)|signature[ _-]?(invalid|fail)|certificate[ _-]?(invalid|chain))"),1,0), skipped_auth=if(match(event_text, "(skip(ped)?|missing|without)[ _-]?(auth|challenge|measurement)"),1,0), replay=if(match(event_text, "(replay|duplicate[ _-]?session|stale[ _-]?session)"),1,0)
| bin _time span=15m
| stats sum(rebind) as rebinds sum(auth_failure) as auth_failures sum(skipped_auth) as skipped_auth_steps sum(replay) as replays dc(peer_ip) as peer_count values(peer_ip) as peer_ips by _time, host
| where rebinds>0 AND (skipped_auth_steps>0 OR replays>0 OR auth_failures>=3 OR peer_count>2)
| table _time, host, rebinds, auth_failures, skipped_auth_steps, replays, peer_count, peer_ips

Microsoft KQL

Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has "migtd" and SyslogMessage has_any ("SPDM", "rebind")
| extend msg = tolower(SyslogMessage)
| extend PeerIp = extract(@"([0-9]{1,3}([.][0-9]{1,3}){3})", 1, SyslogMessage)
| extend Rebind = iff(msg contains "rebind", 1, 0),
         AuthFailure = iff(msg matches regex @"(auth(entication)?[ _-]?(fail|error|mismatch)|nonce[ _-]?(reuse|replay|mismatch)|signature[ _-]?(invalid|fail)|certificate[ _-]?(invalid|chain))", 1, 0),
         SkippedAuth = iff(msg matches regex @"(skip(ped)?|missing|without)[ _-]?(auth|challenge|measurement)", 1, 0),
         Replay = iff(msg matches regex @"(replay|duplicate[ _-]?session|stale[ _-]?session)", 1, 0)
| summarize Rebinds = sum(Rebind), AuthFailures = sum(AuthFailure), SkippedAuthSteps = sum(SkippedAuth), Replays = sum(Replay), PeerCount = dcount(PeerIp), PeerIps = make_set(PeerIp, 10) by bin(TimeGenerated, 15m), Computer
| where Rebinds > 0 and (SkippedAuthSteps > 0 or Replays > 0 or AuthFailures >= 3 or PeerCount > 2)
| project TimeGenerated, Computer, Rebinds, AuthFailures, SkippedAuthSteps, Replays, PeerCount, PeerIps

Sigma

title: Intel TDX MigTD SPDM Rebind Authentication Anomaly (INTEL-SA-01580)
id: 7b2e9d14-5c80-4a3f-96e1-d0a4c8f15a11
status: experimental
description: Detects MigTD log lines showing SPDM rebind together with skipped authentication, replayed or stale sessions, or authentication failures, consistent with abuse of CVE-2026-61887, CVE-2026-44685 or CVE-2026-61473 in migtd versions before 0.7.2.
references:
    - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html
    - https://www.securityweek.com/chipmaker-patch-tuesday-over-200-vulnerabilities-addressed-by-intel-amd/
author: Threadlinqs Team
date: 2026-11-11
tags:
    - attack.lateral_movement
    - attack.t1210
    - attack.credential_access
    - attack.t1557
    - attack.defense_evasion
    - attack.t1211
    - cve.2026-61887
    - cve.2026-44685
    - cve.2026-61473
logsource:
    product: linux
    service: syslog
detection:
    selection_service:
        - 'migtd'
    selection_protocol:
        - 'SPDM'
        - 'rebind'
    selection_anomaly:
        - 'authentication failed'
        - 'auth failure'
        - 'nonce reuse'
        - 'nonce mismatch'
        - 'replay'
        - 'stale session'
        - 'duplicate session'
        - 'signature invalid'
        - 'skipped authentication'
        - 'missing authentication'
    condition: selection_service and selection_protocol and selection_anomaly
falsepositives:
    - Misconfigured peer certificates or clock skew during planned live-migration testing
    - Network flaps causing legitimate session re-establishment
level: high

Known false positives:

• Misconfigured peer certificates or clock skew during planned live-migration testing
• Legitimate session re-establishment after network flaps between migration peers
• Security validation or fuzzing of MigTD in a pre-production environment

Tuning notes: Replace index=linux and the sourcetype list with the index that receives hypervisor and MigTD service-TD logs. Confirm the exact MigTD log wording in your build and adjust the regexes. Raise auth_failures and peer_count thresholds if live migration is frequent. Enrich with a lookup of approved migration peers. Pair with a MigTD version inventory: any host still on a version below 0.7.2 should be treated as higher risk.

• 🔒 MigTD Crash or Restart Loop Consistent with virtio-vsock Memory Corruption · unlock with TL Creds
• 🔒 UEFI Variable and Secure Boot Database Modification via PowerShell · unlock with TL Creds
• 🔒 AMD Management Console Stored Credential Harvesting · unlock with TL Creds
• 🔒 Adjacent-Network Spoofing Indicators on TD Migration Segment · unlock with TL Creds
• 🔒 Physical Memory and Firmware Access Driver Load (Privilege Escalation to Firmware) · unlock with TL Creds
• 🔒 Discontinued Intel BigDL Installation or Execution (Unpatched Privilege Escalation) · unlock with TL Creds
• 🔒 Firmware Flashing and Platform Security Tool Execution (UEFI/SMM Tampering) · unlock with TL Creds
• 🔒 AMD IOMMU Fault Bursts Indicating Guest-Triggered Denial of Service · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-5745.

Technical analysis

Intel's November 2026 release covers 24 advisories dated 2026-11-10. The largest, INTEL-SA-01580 (Intel TDX Migration Trust Domain, MigTD, reference software), lists 30 CVEs across all MigTD versions before 0.7.2 (original release and last revision both 2026-11-10, revision 1.0); individual CVSS 4.0 scores range from 2.0 to 9.4. Three are Critical: CVE-2026-61887 (9.4, missing authentication step in SPDM rebind; escalation of privilege and information disclosure; SecurityWeek notes it may also allow remote code execution), CVE-2026-44685 (9.3, authentication bypass by spoofing in the rebinding protocol; EoP) and CVE-2026-61473 (9.2, authentication bypass by capture-replay; EoP). Six High-severity MigTD flaws: CVE-2026-57890 (improper cleanup on thrown exception in SPDM responder, info disclosure, 8.7), CVE-2026-60138 (out-of-range pointer offset in virtio-vsock, 8.4), CVE-2026-60142 (write-what-where condition, 8.4), CVE-2026-62929 (expired pointer dereference in virtio-vsock, 8.4), CVE-2026-56432 (confused deputy in signing, 8.2) and CVE-2026-57892 (insufficient access control granularity in the v2 policy engine, 8.8). The remaining 21 are medium/low: vsock and virtio-serial input validation and integer overflow DoS, a GetQuote infinite loop (CVE-2026-55709), TLS client/implementation lifetime and return-value bugs, a TOCTOU race in shared memory (CVE-2026-49036), a use-after-free in the virtio driver (CVE-2026-61467), PCI BAR handling (CVE-2026-56759), vmcall_raw error handling and off-by-one bugs, uninitialized or uncleared memory disclosures, and an incorrect buffer size calculation in servtd_get_quote (CVE-2026-61383, 2.0, the lowest). Intel credits vic5589 (via Intigriti) for CVE-2026-61467; the rest were found internally. The advisory lists no CWE IDs.

Other Intel advisories: high-severity privilege escalation in Slim Bootloader, UEFI firmware for Server Boards D50DNP and M50FCP, and VTune Profiler; high-severity DoS in PROSet/Wireless WiFi, Wireless Bluetooth and Performance Counter Monitor; medium privilege escalation or DoS in graphics, NPU and QAT (Windows) drivers, Neural Compressor, Hyperscan, oneDNN, oneAPI CLI Tool, TDX Workload Attestation and Metrics Discovery API; further medium advisories for Application Optimization, Media Transcode Accelerator, Multi-Buffer Crypto for IPSec, ISA-L, Computing Improvement Program and Platform Monitoring Technology; one low issue in AI Playground. Three medium privilege escalation flaws in BigDL will not be patched because the product is discontinued; Intel advises uninstalling it or ceasing use as soon as possible.

AMD published 29 bulletins and two security briefs covering roughly 100 unique CVEs (some not AMD-specific), none critical. High-severity firmware issues: a UEFI flaw letting a privileged attacker execute arbitrary code in System Management Mode (SMM), a Secure Debug Unlock protection bypass, and one bulletin covering an IOMMU flaw (guest VM attacker can cause denial of service) plus a TianoCore EDK II SMM memory corruption bug. High-severity software issues: missing authentication in AMD Management Console that could expose stored credentials (plus a separate InstallShield-related privilege escalation bulletin) and privilege escalation in Vivado Lab Solutions. One graphics bulletin covers 44 issues in Radeon and Instinct products (10 high). More than two dozen medium-severity SEV (Secure Encrypted Virtualization) issues were fixed. Other medium/low bulletins cover AMD Secure Processor, IOMMU, NBIO, power management firmware, RAIDXpert2, an embedded SPI flash driver, Bootgen, Versal adaptive SoCs and a transient execution issue. An additional Transient Scheduler Attacks (TSA) mitigation bulletin covers Zen 5, which AMD says is affected differently than older CPUs; researchers from ETH Zurich and Google reported that missing TSA mitigations in EDK II could let a privileged attacker infer SMM memory contents. Some AMD mitigations were released months or years earlier, others are pending, and some are expected as late as 2027.

The sources do not report in-the-wild exploitation or public proof-of-concept code. Defender priority: deploy MigTD 0.7.2+ in confidential-computing/live-migration environments, apply platform firmware (UEFI/SMM) updates, and retire Intel BigDL.

MITRE ATT&CK techniques by tactic:

Impact

T1499.004 Application or System Exploitation

Persistence

T1542 Pre-OS Boot; T1542.001 System Firmware

Defense Evasion

T1542 Pre-OS Boot

Credential Access

T1552 Unsecured Credentials; T1557 Adversary-in-the-Middle

Remediation

Patches

• Intel MigTD 0.7.2 (GitHub release v0.7.2)
• AMD November 2026 bulletins: UEFI SMM, Secure Debug Unlock, IOMMU, EDK II, AMD Management Console, Vivado Lab Solutions, SEV, Radeon/Instinct graphics, TSA Zen 5

Immediate actions

• Update Intel TDX MigTD reference software to version 0.7.2 or later (INTEL-SA-01580)
• Inventory and uninstall Intel BigDL (discontinued, three privilege escalation flaws will not be fixed)
• Apply Intel November 2026 advisories for Slim Bootloader, D50DNP/M50FCP UEFI firmware, VTune Profiler, graphics/NPU/QAT drivers and wireless drivers

Workarounds

• Restrict adjacent-network exposure of MigTD SPDM/rebinding endpoints until updated
• Limit administrative access to AMD Management Console and rotate credentials it stores

Longer-term hardening

• Track AMD bulletins with mitigations pending (some as late as 2027) via AMD product security page
• Monitor firmware, UEFI and SMM integrity and restrict privileged access to platform firmware update paths

Affected and fixed versions

• Intel — TDX Migration Trust Domain (MigTD) reference software
  Vulnerable versions: All versions before 0.7.2
  Fixed in: 0.7.2
• Intel — BigDL
  Vulnerable versions: All versions (product discontinued)
• Intel — Slim Bootloader, Server Board D50DNP/M50FCP UEFI firmware, VTune Profiler, PROSet/Wireless WiFi, Wireless Bluetooth, PCM, graphics/NPU/QAT drivers and other November 2026 advisories
  Vulnerable versions: See individual Intel advisories dated 2026-11-10
  Fixed in: See individual Intel advisories
• AMD — UEFI/SMM firmware, Secure Debug Unlock, IOMMU, TianoCore EDK II, SEV, Management Console, Vivado Lab Solutions, Radeon/Instinct graphics, Zen 5 (TSA)
  Vulnerable versions: See individual AMD bulletins
  Fixed in: See individual AMD bulletins; some mitigations pending into 2027

Timeline

• 2026-11-10 ETH Zurich and Google researchers credited for reporting that missing TSA mitigations in EDK II could let a privileged attacker infer SMM memory contents; AMD issues additional Zen 5 TSA mitigations bulletin.
• 2026-11-10 AMD graphics bulletin covers 44 Radeon/Instinct issues (10 high) and SEV bulletins fix more than two dozen medium-severity issues.
• 2026-11-10 AMD Patch Tuesday release: 29 bulletins and two security briefs (~100 unique CVEs), including SMM code execution in UEFI, Secure Debug Unlock bypass, IOMMU guest DoS, EDK II SMM corruption, Management Console missing authentication, and a Zen 5 TSA mitigation bulletin.
• 2026-11-10 Intel releases fixes for high-severity privilege escalation in Slim Bootloader, D50DNP/M50FCP server board UEFI firmware and VTune Profiler, and high-severity DoS in PROSet/Wireless WiFi, Bluetooth and PCM.
• 2026-11-10 Intel discloses three medium privilege escalation flaws in BigDL (INTEL-SA-01553) with no patch because the product is discontinued; users told to uninstall.
• 2026-11-10 Intel credits vic5589 (via Intigriti) for CVE-2026-61467 (use after free in MigTD virtio driver); all other MigTD issues were found internally.
• 2026-11-10 INTEL-SA-01580 released (revision 1.0): 30 CVEs in TDX MigTD reference software, including critical CVE-2026-61887, CVE-2026-44685 and CVE-2026-61473; fixed in MigTD 0.7.2.
• 2026-11-10 Intel publishes 24 security advisories (about 100 CVEs; 3 critical, 20 high) on its Product Security Center.
• 2026-11-11 SecurityWeek reports over 200 vulnerabilities addressed by Intel and AMD; no exploitation or public PoC stated, and some AMD mitigations remain pending as late as 2027.

Sources cited

• INTEL-SA-01580: Intel TDX MigTD Advisory intel.com · Vendor report · 2026-11-10
• Intel Product Security Center Advisories intel.com · Vendor report · 2026-11-10
• AMD Product Security amd.com · Vendor report · 2026-11-10
• INTEL-SA-01436: Intel TDX Module Advisory (prior TDX module CVEs) intel.com · Vendor report
• Intel TDX 1.5 Security Review (Google) services.google.com · Research
• Chipmaker Patch Tuesday: Over 200 Vulnerabilities Addressed by Intel, AMD SecurityWeek · News · 2026-11-11
• Google-Intel Security Audit Reveals Severe TDX Vulnerability Allowing Full Compromise SecurityWeek · News

More in vulnerability

• Critical Zoom Workplace for Windows Flaws (CVE-2026-108186, CVE-2026-108187) Allow Unauthenticated Remote Privilege Escalation
• Windows SignDrop 0-Day: CLFS (clfs.sys) Local Privilege Escalation to SYSTEM with Public PoC (No CVE Assigned)
• Ivanti EPM SQLi RCE (CVE-2026-121653) and CSA Missing Authentication (CVE-2026-121683); Citrix XenServer and Ivanti Sentry/EPMM Patches
• Git Fixes 6 Vulnerabilities Enabling Code Execution via Cloned Repositories (CVE-2026-111760 et al.)
• CVE-2024-0244 – Unauthenticated Heap Buffer Overflow in Canon MF753Cdw Printer (Fax Job Handling, /wsd/print)

Previous and next in vulnerability

• Windows Active Directory RCE Vulnerability (CVE-2026-119948) Allows Code Execution Over a Network Previous report
• Local Privilege Escalation in Iperius Backup 8.8.3 for Windows via Elevated GUI Native Dialogs (CVE-2026-112174) Next report