Latest XCP-ng vulnerabilities: #
On April 24, 2026, researchers publicly disclosed an audit identifying 89 exploitable vulnerabilities. These issues primarily involve missing input validation across all writable Map(String,String) fields within eight XAPI object types. Consequently, an attacker with the vm-admin management role could theoretically "achieve full host filesystem read/write [access]" and execute "cross-VM data exfiltration" or "pool-wide compromise." The report claims these actions are possible through "single API calls with no exploit code," requiring neither a root shell nor triggering security alerts. These vulnerabilities reportedly persisted since the inception of the XAPI codebase (circa 2006). The researchers assigned a CVSS distribution of 5 critical, 28 high, 46 medium, and 10 low, stating that all versions of Citrix XenServer / Hypervisor, XCP-ng, and XAPI-based distributions were affected.
On April 28, 2026, the Xen Project (upstream) and XCP-ng (downstream) released advisories addressing these claims. The Xen Project issued technical advisories XSA-483 through XSA-489 to address the core source code. Notably, XSA-489 serves as a direct rebuttal to the April 24 audit, concluding that only five of the 89 claims were actionable. The remainder were identified as intended Role-Based Access Control (RBAC) functionality or, in several instances, appeared to be "AI hallucinations" within the researcher's report. Simultaneously, XCP-ng published a blog providing specific security and maintenance updates focused on the practical impact on XCP-ng environments.
The following vulnerabilities have been confirmed by the vendors:
- CVE-2026-23556 (VSA-2026-007, XSA-483): A flaw where oxenstored keeps quota-related use counts across domain destruction. XCP-ng notes this could allow a privileged user in a guest domain to trigger a denial-of-service (DoS) condition by preventing other domains from starting; the XCP-ng advisory classifies this impact as critical.
- CVE-2026-23557 (XSA-484): A denial-of-service (DoS) vulnerability via the XS_RESET_WATCHES command in xenstored.
- CVE-2026-31786 (XSA-485): A Linux kernel out-of-bounds read via a Xen-related sysfs file, potentially leaking sensitive information.
- CVE-2026-23558 (VSA-2026-008, XSA-486): A race condition in grant table v2 status page mapping. XCP-ng notes this use-after-free (UAF) flaw could allow a privileged user in a HVM or PVH guest domain to escalate their privileges to the hypervisor level; the XCP-ng advisory classifies this impact as critical.
- CVE-2026-31787 (XSA-487): A Linux kernel double-free in the Xen privcmd driver; as it requires root privileges, the Xen Project considers the crash potential not security-relevant.
- CVE-2025-54505 (VSA-2026-010, XSA-488): Addresses "Floating Point Divider State Sampling" on certain AMD CPUs. While not a XCP-ng software vulnerability, this update mitigates a hardware issue to prevent a guest VM from inferring data from another VM; the XCP-ng advisory classifies this impact as moderate.
- XAPI RBAC Escalation (VSA-2026-011, XSA-489): This advisory confirms five actionable vulnerabilities: CVE-2026-23559, CVE-2026-23560, CVE-2026-23561, CVE-2026-23562, and CVE-2026-42486. While the first three may allow vm-admin role users to escalate to root privileges in the control domain, the flaw relies on advanced RBAC features not typically exposed in standard management tools or documentation; the XCP-ng advisory classifies this impact as low. This would only impact users with a specific configuration involving an XCP-ng pool using Active Directory for user management where the managed user has the XAPI role vm-admin.
Note: Current advisories suggest that Xen Project vulnerabilities CVE-2026-23557, CVE-2026-31786, CVE-2026-31787, CVE-2026-23562, and CVE-2026-42486 have not yet been addressed specifically by XCP-ng updates.
The following versions are affected:
- XCP-ng: Version 8.3
Note: XCP-ng 8.3 LTS is currently the only release not marked end-of-life (EOL). Therefore, older versions are likely susceptible to these vulnerabilities but fall outside the scope of current security patching and support.
What is XCP-ng? #
XCP-ng (Xen Cloud Platform - next generation) is a bare-metal hypervisor based on the open-source Xen project that enables multiple virtual machines to run concurrently on a single physical server.
What is the impact? #
Successful exploitation of the vulnerabilities allows a remote, authenticated attacker to gain unauthorized host filesystem control and breach VM isolation boundaries.
Are updates or workarounds available? #
Users are encouraged upgrade affected systems to the following versions immediately:
- XCP-ng 8.3: Upgrade to package xen-4.17.6-6.2.xcpng8.3 or later.
- XCP-ng 8.2 and prior: These versions are EOL. Users should evaluate environmental risk and migrate to a supported release.
How to find potentially vulnerable systems with runZero #
From the Service inventory, use the following query to locate potentially impacted assets:
_asset.protocol:http AND protocol:http AND (html.title:="Welcome to XCP-ng%" OR html.title:="XO Lite")
