Loading story…
Xen disclosed XSA-489 covering five role-based access control flaws in XAPI, tracked as CVE-2026-23559, CVE-2026-23560, CVE-2026-23561, CVE-2026-23562, and CVE-2026-42486. The vulnerabilities affect deployments where RBAC is enabled and roles such as vm-admin, vm-power-admin, or pool-operator are assigned, allowing those lower-privileged administrators to perform actions intended only for pool-admin. Xen said the impact includes privilege escalation and, in some cases, arbitrary dom0 file read, modification, or write.
The advisory states that all versions of XAPI are vulnerable under the affected RBAC conditions. Xen urged administrators to disable RBAC subjects assigned to vm-admin, vm-power-admin, or pool-operator until patches are applied. Fixes have been merged and backported in XAPI and are available in releases v26.12.0 and v26.1.11. Xen also noted the issues were publicly disclosed without embargo and said maintainers validated five real vulnerabilities out of 89 claims submitted by the researcher.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
A version 2 advisory was circulated on oss-sec with additional detail on the five validated RBAC vulnerabilities, including that some flaws could enable arbitrary dom0 file read, modification, or write. The notice reiterated affected roles, mitigation guidance, and fixed versions.
Xen published Security Advisory XSA-489 covering CVE-2026-23559, CVE-2026-23560, CVE-2026-23561, CVE-2026-23562, and CVE-2026-42486. The advisory says all XAPI versions are affected when RBAC is enabled and certain lower-privileged roles are assigned, and recommends disabling vm-admin, vm-power-admin, or pool-operator RBAC subjects until patches are applied.
Fixes for the validated RBAC vulnerabilities were merged and backported in XAPI. The remediations were made available in XAPI releases v26.12.0 and v26.1.11.
A researcher publicly disclosed a large set of claimed RBAC issues in Xen XAPI without embargo. XAPI maintainers later said they validated 5 real vulnerabilities out of 89 claims submitted.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcexenbits.xen.org
Open sourcegna.moksha.dk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Citrix issued security bulletin **CTX696527** for **XenServer** on April 28, warning that multiple vulnerabilities affect releases prior to **8.4** and urging customers to apply vendor updates and mitigations. Canada’s Centre for Cyber Security echoed the notice in advisory **AV26-400**, telling administrators to review Citrix guidance and remediate affected systems. Germany’s dCERT also published an advisory covering multiple vulnerabilities in **Xen** and **Citrix XenServer**, underscoring broad government attention to the issue. The disclosures followed public claims that **89** XAPI-related vulnerabilities were exploitable across Xen-based platforms, including scenarios involving host filesystem access, cross-VM data exposure, and pool-wide compromise. Subsequent vendor and upstream advisories narrowed the confirmed impact: Xen Project bulletin **XSA-489** said only **five** of those claims were actionable, while related advisories identified a smaller set of real risks including denial of service, information disclosure, race-condition and privilege-boundary issues, a Linux kernel out-of-bounds read, and a grant-table use-after-free that could enable hypervisor-level privilege escalation in some configurations.
Jun 29, 2026
Xen has disclosed two Linux guest kernel vulnerabilities affecting virtualized environments, warning that both issues require patching and have no known mitigations. **CVE-2026-31786** (`XSA-485`) affects Linux kernels **4.13 and later** in Xen domains through unsafe handling of the binary build ID exposed at `/sys/hypervisor/properties/buildid`. The bug uses `sprintf()` on a non-null-terminated binary value, which can trigger an out-of-bounds read and, in rare cases, a write past the 4 KB sysfs buffer, potentially leading to **information disclosure, denial of service, or privilege escalation** inside Linux Xen guests. A second advisory, **CVE-2026-31787** (`XSA-487`), describes a **double-free** flaw in the Linux **Xen `privcmd` driver** that allows a **root user in a Linux guest** to bypass kernel lockdown protections tied to secure boot. Xen said the issue affects Linux **PVH or HVM domains** on **x86 and Arm** from kernel **3.8 onward**, while PV domains and non-Linux guests are not affected. The vulnerabilities were reported by **Frediano Ziglio of XenServer** and **Atharva Vartak (@0xAth4rv)**, respectively, and Xen urged operators to apply the supplied Linux patches.
Jun 29, 2026
Xen disclosed **XSA-499 v2** for two vulnerabilities, **`CVE-2026-62426`** and **`CVE-2026-62427`**, affecting sysctl and platform operations that rely on system-wide locks for privileged management tasks. The flaws stem from unfair lock acquisition, allowing a less privileged entity to repeatedly obtain locks needed by the control domain or a Xenstore domain and block other operations that cannot safely run in parallel. In deployments using **XSM/Flask**, Xen said some lock acquisitions can occur **before permission checks**, worsening the impact and enabling denial-of-service conditions that may extend to the entire host. Xen reported that all versions from **4.0 onward** are confirmed vulnerable, earlier releases may also be affected, and there is **no known mitigation** beyond applying the vendor patches; environments using Flask also need a default policy adjustment, with corresponding updates required for custom policies.
Jul 28, 2026