# Intel and AMD November 2026 Patch Tuesday: 200+ vulnerabilities incl. critical TDX MigTD flaws (CVE-2026-61887, CVE-2026-44685, CVE-2026-61473)

> On 2026-11-10 Intel published 24 advisories (~100 CVEs) and AMD published 29 bulletins plus two briefs (~100 CVEs). The most severe are three critical (CVSS 4.0 9.2-9.4) authentication flaws in Intel TDX MigTD reference software, fixed in MigTD 0.7.2. No exploitation or public PoC is reported.

- **Published:** 2026-11-11T08:57:29Z
- **Last reviewed:** 2026-11-11T08:57:29Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5745
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5745.png
- **ID:** TL-2026-5745
- **Severity:** CRITICAL (CVSS 9.4)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 19
- **CVEs:** CVE-2026-61887, CVE-2026-44685, CVE-2026-61473, CVE-2026-57890, CVE-2026-60138, CVE-2026-60142, CVE-2026-62929, CVE-2026-56432, CVE-2026-57892, CVE-2026-60059, CVE-2026-60139, CVE-2026-60071, CVE-2026-60133, CVE-2026-61470, CVE-2026-61468, CVE-2026-55709, CVE-2026-63027, CVE-2026-63028, CVE-2026-56759, CVE-2026-49036, CVE-2026-62920, CVE-2026-62275, CVE-2026-61377, CVE-2026-61469, CVE-2026-61383, CVE-2026-61467, CVE-2026-59771, CVE-2026-57893, CVE-2026-62930, CVE-2026-60020

## Description

Intel's November 2026 release covers 24 advisories dated 2026-11-10. The largest, INTEL-SA-01580 (Intel TDX Migration Trust Domain, MigTD, reference software), lists 30 CVEs across all MigTD versions before 0.7.2 (original release and last revision both 2026-11-10, revision 1.0); individual CVSS 4.0 scores range from 2.0 to 9.4. Three are Critical: CVE-2026-61887 (9.4, missing authentication step in SPDM rebind; escalation of privilege and information disclosure; SecurityWeek notes it may also allow remote code execution), CVE-2026-44685 (9.3, authentication bypass by spoofing in the rebinding protocol; EoP) and CVE-2026-61473 (9.2, authentication bypass by capture-replay; EoP). Six High-severity MigTD flaws: CVE-2026-57890 (improper cleanup on thrown exception in SPDM responder, info disclosure, 8.7), CVE-2026-60138 (out-of-range pointer offset in virtio-vsock, 8.4), CVE-2026-60142 (write-what-where condition, 8.4), CVE-2026-62929 (expired pointer dereference in virtio-vsock, 8.4), CVE-2026-56432 (confused deputy in signing, 8.2) and CVE-2026-57892 (insufficient access control granularity in the v2 policy engine, 8.8). The remaining 21 are medium/low: vsock and virtio-serial input validation and integer overflow DoS, a GetQuote infinite loop (CVE-2026-55709), TLS client/implementation lifetime and return-value bugs, a TOCTOU race in shared memory (CVE-2026-49036), a use-after-free in the virtio driver (CVE-2026-61467), PCI BAR handling (CVE-2026-56759), vmcall_raw error handling and off-by-one bugs, uninitialized or uncleared memory disclosures, and an incorrect buffer size calculation in servtd_get_quote (CVE-2026-61383, 2.0, the lowest). Intel credits vic5589 (via Intigriti) for CVE-2026-61467; the rest were found internally. The advisory lists no CWE IDs.

Other Intel advisories: high-severity privilege escalation in Slim Bootloader, UEFI firmware for Server Boards D50DNP and M50FCP, and VTune Profiler; high-severity DoS in PROSet/Wireless WiFi, Wireless Bluetooth and Performance Counter Monitor; medium privilege escalation or DoS in graphics, NPU and QAT (Windows) drivers, Neural Compressor, Hyperscan, oneDNN, oneAPI CLI Tool, TDX Workload Attestation and Metrics Discovery API; further medium advisories for Application Optimization, Media Transcode Accelerator, Multi-Buffer Crypto for IPSec, ISA-L, Computing Improvement Program and Platform Monitoring Technology; one low issue in AI Playground. Three medium privilege escalation flaws in BigDL will not be patched because the product is discontinued; Intel advises uninstalling it or ceasing use as soon as possible.

AMD published 29 bulletins and two security briefs covering roughly 100 unique CVEs (some not AMD-specific), none critical. High-severity firmware issues: a UEFI flaw letting a privileged attacker execute arbitrary code in System Management Mode (SMM), a Secure Debug Unlock protection bypass, and one bulletin covering an IOMMU flaw (guest VM attacker can cause denial of service) plus a TianoCore EDK II SMM memory corruption bug. High-severity software issues: missing authentication in AMD Management Console that could expose stored credentials (plus a separate InstallShield-related privilege escalation bulletin) and privilege escalation in Vivado Lab Solutions. One graphics bulletin covers 44 issues in Radeon and Instinct products (10 high). More than two dozen medium-severity SEV (Secure Encrypted Virtualization) issues were fixed. Other medium/low bulletins cover AMD Secure Processor, IOMMU, NBIO, power management firmware, RAIDXpert2, an embedded SPI flash driver, Bootgen, Versal adaptive SoCs and a transient execution issue. An additional Transient Scheduler Attacks (TSA) mitigation bulletin covers Zen 5, which AMD says is affected differently than older CPUs; researchers from ETH Zurich and Google reported that missing TSA mitigations in EDK II could let a privileged attacker infer SMM memory contents. Some AMD mitigations were released months or years earlier, others are pending, and some are expected as late as 2027.

The sources do not report in-the-wild exploitation or public proof-of-concept code. Defender priority: deploy MigTD 0.7.2+ in confidential-computing/live-migration environments, apply platform firmware (UEFI/SMM) updates, and retire Intel BigDL.

## MITRE ATT&CK

- T1499.004 Application or System Exploitation
- T1542 Pre-OS Boot
- T1542.001 System Firmware
- T1542 Pre-OS Boot
- T1552 Unsecured Credentials
- T1557 Adversary-in-the-Middle

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Intel TDX MigTD SPDM Rebind Authentication Anomalies (INTEL-SA-01580, CVE-2026-61887/44685/61473)** (`TL-2026-5745-SPL-001`)

Behaviour-first hunt for exploitation of the critical Intel TDX MigTD authentication flaws in INTEL-SA-01580 (migtd < 0.7.2): a missing authentication step in the SPDM rebind (CVE-2026-61887), spoofing of the rebinding protocol (CVE-2026-44685) and capture-replay of the authentication exchange (CVE-2026-61473). Aggregates MigTD/SPDM log lines per host in 15-minute windows and alerts when rebind activity coincides with skipped authentication steps, replayed or stale sessions, repeated authentication failures, or an unusual number of distinct peers. No public PoC or in-the-wild exploitation is reported, so this is an early-warning detection for confidential-computing live-migration hosts.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1210, T1557, T1211
- **Data sources:** linux_syslog, journald, intel_tdx_migtd_logs
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=linux (sourcetype=syslog OR sourcetype=journald) earliest=-24h "migtd" ("SPDM" OR "rebind")
| eval event_text=lower(_raw)
| rex field=_raw "(?<peer_ip>[0-9]{1,3}(?:[.][0-9]{1,3}){3})"
| eval rebind=if(match(event_text, "rebind"),1,0), auth_failure=if(match(event_text, "(auth(entication)?[ _-]?(fail|error|mismatch)|nonce[ _-]?(reuse|replay|mismatch)|signature[ _-]?(invalid|fail)|certificate[ _-]?(invalid|chain))"),1,0), skipped_auth=if(match(event_text, "(skip(ped)?|missing|without)[ _-]?(auth|challenge|measurement)"),1,0), replay=if(match(event_text, "(replay|duplicate[ _-]?session|stale[ _-]?session)"),1,0)
| bin _time span=15m
| stats sum(rebind) as rebinds sum(auth_failure) as auth_failures sum(skipped_auth) as skipped_auth_steps sum(replay) as replays dc(peer_ip) as peer_count values(peer_ip) as peer_ips by _time, host
| where rebinds>0 AND (skipped_auth_steps>0 OR replays>0 OR auth_failures>=3 OR peer_count>2)
| table _time, host, rebinds, auth_failures, skipped_auth_steps, replays, peer_count, peer_ips
```

### Microsoft KQL

```kql
Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has "migtd" and SyslogMessage has_any ("SPDM", "rebind")
| extend msg = tolower(SyslogMessage)
| extend PeerIp = extract(@"([0-9]{1,3}([.][0-9]{1,3}){3})", 1, SyslogMessage)
| extend Rebind = iff(msg contains "rebind", 1, 0),
         AuthFailure = iff(msg matches regex @"(auth(entication)?[ _-]?(fail|error|mismatch)|nonce[ _-]?(reuse|replay|mismatch)|signature[ _-]?(invalid|fail)|certificate[ _-]?(invalid|chain))", 1, 0),
         SkippedAuth = iff(msg matches regex @"(skip(ped)?|missing|without)[ _-]?(auth|challenge|measurement)", 1, 0),
         Replay = iff(msg matches regex @"(replay|duplicate[ _-]?session|stale[ _-]?session)", 1, 0)
| summarize Rebinds = sum(Rebind), AuthFailures = sum(AuthFailure), SkippedAuthSteps = sum(SkippedAuth), Replays = sum(Replay), PeerCount = dcount(PeerIp), PeerIps = make_set(PeerIp, 10) by bin(TimeGenerated, 15m), Computer
| where Rebinds > 0 and (SkippedAuthSteps > 0 or Replays > 0 or AuthFailures >= 3 or PeerCount > 2)
| project TimeGenerated, Computer, Rebinds, AuthFailures, SkippedAuthSteps, Replays, PeerCount, PeerIps
```

### Sigma

```yaml
title: Intel TDX MigTD SPDM Rebind Authentication Anomaly (INTEL-SA-01580)
id: 7b2e9d14-5c80-4a3f-96e1-d0a4c8f15a11
status: experimental
description: Detects MigTD log lines showing SPDM rebind together with skipped authentication, replayed or stale sessions, or authentication failures, consistent with abuse of CVE-2026-61887, CVE-2026-44685 or CVE-2026-61473 in migtd versions before 0.7.2.
references:
    - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html
    - https://www.securityweek.com/chipmaker-patch-tuesday-over-200-vulnerabilities-addressed-by-intel-amd/
author: Threadlinqs Team
date: 2026-11-11
tags:
    - attack.lateral_movement
    - attack.t1210
    - attack.credential_access
    - attack.t1557
    - attack.defense_evasion
    - attack.t1211
    - cve.2026-61887
    - cve.2026-44685
    - cve.2026-61473
logsource:
    product: linux
    service: syslog
detection:
    selection_service:
        - 'migtd'
    selection_protocol:
        - 'SPDM'
        - 'rebind'
    selection_anomaly:
        - 'authentication failed'
        - 'auth failure'
        - 'nonce reuse'
        - 'nonce mismatch'
        - 'replay'
        - 'stale session'
        - 'duplicate session'
        - 'signature invalid'
        - 'skipped authentication'
        - 'missing authentication'
    condition: selection_service and selection_protocol and selection_anomaly
falsepositives:
    - Misconfigured peer certificates or clock skew during planned live-migration testing
    - Network flaps causing legitimate session re-establishment
level: high
```

**Known false positives:**

- Misconfigured peer certificates or clock skew during planned live-migration testing
- Legitimate session re-establishment after network flaps between migration peers
- Security validation or fuzzing of MigTD in a pre-production environment

**Tuning notes:** Replace index=linux and the sourcetype list with the index that receives hypervisor and MigTD service-TD logs. Confirm the exact MigTD log wording in your build and adjust the regexes. Raise auth_failures and peer_count thresholds if live migration is frequent. Enrich with a lookup of approved migration peers. Pair with a MigTD version inventory: any host still on a version below 0.7.2 should be treated as higher risk.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- MigTD Crash or Restart Loop Consistent with virtio-vsock Memory Corruption (locked: unlock with TL Creds)
- UEFI Variable and Secure Boot Database Modification via PowerShell (locked: unlock with TL Creds)
- AMD Management Console Stored Credential Harvesting (locked: unlock with TL Creds)
- Adjacent-Network Spoofing Indicators on TD Migration Segment (locked: unlock with TL Creds)
- Physical Memory and Firmware Access Driver Load (Privilege Escalation to Firmware) (locked: unlock with TL Creds)
- Discontinued Intel BigDL Installation or Execution (Unpatched Privilege Escalation) (locked: unlock with TL Creds)
- Firmware Flashing and Platform Security Tool Execution (UEFI/SMM Tampering) (locked: unlock with TL Creds)
- AMD IOMMU Fault Bursts Indicating Guest-Triggered Denial of Service (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Chipmaker Patch Tuesday: Over 200 Vulnerabilities Addressed by Intel, AMD](https://www.securityweek.com/chipmaker-patch-tuesday-over-200-vulnerabilities-addressed-by-intel-amd/)
- [INTEL-SA-01580: Intel TDX MigTD Advisory](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html)
- [Intel Product Security Center Advisories](https://www.intel.com/content/www/us/en/security-center/default.html)
- [AMD Product Security](https://www.amd.com/en/resources/product-security.html)
- [INTEL-SA-01436: Intel TDX Module Advisory (prior TDX module CVEs)](https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01436.html)
- [Google-Intel Security Audit Reveals Severe TDX Vulnerability Allowing Full Compromise](https://www.securityweek.com/google-intel-security-audit-reveals-severe-tdx-vulnerability-allowing-full-compromise/)
- [Intel TDX 1.5 Security Review (Google)](https://services.google.com/fh/files/misc/intel_tdx_1.5-full_report.pdf)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5745