Role-Based Access Control Vulnerabilities in XenServer by Citrix
CVE-2026-23560

9.4CRITICAL

Key Information:

Vendor

Xen Project
Status
Xapi
Vendor
CVE Published:
9 July 2026

What is CVE-2026-23560?

The vulnerability arises from improper configurations within the Role-Based Access Control (RBAC) system in XenServer. A vm-admin can incorrectly set a VM as a system domain, which may lead to its undesired continuation during critical host operations, potentially obscuring it from administrative oversight. This allows standard administrative users to manipulate system domain settings inappropriately, compromising the integrity and security of the overall virtual environment.

Affected Version(s)

XAPI all

References

https://xenbits.xen.org/xsa/advisory-489.html

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.