CVE-2026-57890

HighCVSS 8.7/10Last modified Nov 10, 2026

Description

Improper cleanup on thrown exception in the MigTD's SPDM responder for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an information disclosure. Network adversary with an unauthenticated user combined with a low complexity attack may enable data exposure. This result may potentially occur via network access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Metrics

CVSS 4.0 8.7/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-460

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
n/a	Intel(R) TDX Migration Trust Domain (MigTD)	See references

References

https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html

Timeline

Published: Nov 10, 2026
Last modified: Nov 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-578918.7Out-of-bounds write in the XmlCliCommonDxe for the Intel(R) Server Board D50DNP and Intel(R) Server Board M50FCP within Ring 0 UEFI may allo CVE-2026-578928.8Insufficient granularity of access control in the MigTD v2 policy evaluation engine for the Intel(R) TDX Migration Trust Domain (MigTD) with CVE-2026-578936.8Incomplete internal state distinction in the MigTD's SPDM responder for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hyper CVE-2026-578948.5Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration CVE-2026-578958.5Incorrect default permissions issue exists in Pupsman versions prior to 3.9.0. An attacker can place a malicious executable in the installat CVE-2026-578966.1An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a craf CVE-2026-578976.5Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs CVE-2026-578989.0In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to CVE-2026-57905.1Stored Cross-Site Scripting (XSS) in Stel Order v3.25.1 and earlier, located at the ‘/app/FrontController’ endpoint via the ‘legalName’ and CVE-2026-579078.5A privilege escalation vulnerability in WatchGuard Endpoint Protection's inter-process communication between the console and the protection CVE-2026-579099.4A path traversal vulnerability in WatchGuard Agent allows a remote, unauthenticated attacker on an adjacent network to execute arbitrary cod CVE-2026-57916.5Cross-Site request forgery (CSRF) vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Cross Site Request Forgery. T