Intel CPUs have an embedded supervisory CPU called the Management Engine. It can read all of memory, control power states on the main CPU, and generally has super-root privileges on everything. You, an end-user, aren't allowed to program it. The current MEs run a form of Minix. They represent an incredible security and privacy risk, because we don't know what code they run and it is widely believed that the NSA or other intelligence agencies have backdoor access. Remote backdoor access, even: the ME can talk to the network.
A JTAG is a standard minimal serial port used for debugging purposes. You'll find them on nearly all embedded devices - routers, phones, TVs, refrigerator controllers... usually appearing as a set of two or three contact points. Sometimes they connect directly to a debugger.
In this case, it appears that at least some Intel CPUs have a JTAG on the ME that can be routed through the on-CPU USB handler, and thus physical access to the right USB ports can be used to access the ME.