Skip to content
OpenAdvisories
High WID-SEC-2026-1306 10 CVEs

Xen und Citrix Systems XenServer: Mehrere Schwachstellen

Published Apr 28, 2026 · Updated Oct 4, 2026 · Revision 21 · de-DE

Vendor: Citrix Vendor: Debian Vendor: Dell Vendor: Fedora Vendor: IBM Vendor: Oracle Vendor: Red Hat Vendor: SUSE Product: Avamar Product: Enterprise Linux Product: Linux Product: Linux Product: Linux Product: Linux Product: NetWorker Product: openSUSE Product: QRadar SIEM Product: Security Verify Access Product: XenServer Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Xen und Citrix Systems XenServer ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten zu verändern und offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.

Product

Xen ist ein Virtueller-Maschinen-Monitor (VMM), der Hardware (x86, IA-64, PowerPC) für die darauf laufenden Systeme (Domains) paravirtualisiert.
Citrix XenServer ist eine Lösung für das Management, die Konfiguration und den Betrieb virtueller Maschinen auf Servern.

Vulnerabilities 10

  • Critical 9.4
    CVE-2026-23556

    oxenstored keeps quota related use counts across domain destruction

    When oxenstored is tearing a domain down, the node data is cleaned up but the usage counts are leaked. When the domain ID is eventually reused, the new domain can create fewer nodes before beeing deemed to be over quota.

    Xen oxenstored xen xen Debian Ubuntu
  • Critical 9.4
    CVE-2026-23559

    Multiple RBAC issues in XAPI

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] XAPI can configure different users with different roles, using Role Based Access Control. For more details, see: https://docs.xens…

    Xen XAPI
  • Critical 9.4
    CVE-2026-23560

    Multiple RBAC issues in XAPI

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] XAPI can configure different users with different roles, using Role Based Access Control. For more details, see: https://docs.xens…

    Xen XAPI
  • Critical 9.4
    CVE-2026-23561

    Multiple RBAC issues in XAPI

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] XAPI can configure different users with different roles, using Role Based Access Control. For more details, see: https://docs.xens…

    Xen XAPI
  • Critical 9.4
    CVE-2026-23562

    Multiple RBAC issues in XAPI

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] XAPI can configure different users with different roles, using Role Based Access Control. For more details, see: https://docs.xens…

    Xen XAPI
  • Critical 9.4
    CVE-2026-42486

    Multiple RBAC issues in XAPI

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] XAPI can configure different users with different roles, using Role Based Access Control. For more details, see: https://docs.xens…

    Xen XAPI
  • High 7.8
    CVE-2026-23558

    grant table v2 race in status page mapping

    The adjustments made for XSA-379 as well as those subsequently becoming XSA-387 still left a race window, when a HVM or PVH guest does a grant table version change from v2 to v1 in parallel with mapping the status page(s) via XENMEM_add_to_physmap. Some of th…

    Xen Xen xen xen Virtualization Debian Ubuntu Alpine
  • High 7.8
    CVE-2026-31786

    Buffer overflow in drivers/xen/sys-hypervisor.c

    In the Linux kernel, the following vulnerability has been resolved: Buffer overflow in drivers/xen/sys-hypervisor.c The build id returned by HYPERVISOR_xen_version(XENVER_build_id) is neither NUL terminated nor a string. The first causes a buffer overflow as …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 6.5
    CVE-2026-23557

    Xenstored DoS via XS_RESET_WATCHES command

    Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES command within a transaction due to an assert() triggering. In case xenstored was built with NDEBUG #defined nothing bad will happen, as assert() is doing nothing in this case. Note that the…

    Xen Xen xen xen Virtualization Debian Ubuntu Alpine
  • Unscored —
    CVE-2026-31787 Public exploit

    xen/privcmd: fix double free via VMA splitting

    In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix double free via VMA splitting privcmd_vm_ops defines .close (privcmd_close), but neither .may_split nor .open. When userspace does a partial munmap() on a privcmd mapping, th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

Revision history

  1. #21

    Neue Updates von Debian und IBM aufgenommen

  2. #20

    Neue Updates von Dell aufgenommen

  3. #19

    Neue Updates von Red Hat aufgenommen

  4. #18

    Neue Updates von Red Hat aufgenommen

  5. #17

    Neue Updates von Debian aufgenommen

  6. #16

    Neue Updates von IBM aufgenommen

  7. #15

    Neue Updates von Red Hat aufgenommen

  8. #14

    Referenz(en) aufgenommen: EUVD-2026-42600

  9. #13

    Neue Updates von Oracle Linux aufgenommen

  10. #12

    Neue Updates von Red Hat aufgenommen

  11. #11

    Neue Updates von SUSE aufgenommen

  12. #10

    Neue Updates von Debian aufgenommen

  13. #9

    Neue Updates von SUSE aufgenommen

  14. #8

    Neue Updates von SUSE aufgenommen

  15. #7

    Neue Updates von SUSE und European Union Vulnerability Database aufgenommen

  16. #6

    Neue Updates von SUSE aufgenommen

  17. #5

    Neue Updates von SUSE aufgenommen

  18. #4

    Neue Updates von openSUSE aufgenommen

  19. #3

    Neue Updates von Debian und European Union Vulnerability Database aufgenommen

  20. #2

    Neue Updates von SUSE und Fedora aufgenommen

  21. #1

    Initiale Fassung

References