Role-Based Access Control Vulnerability in XenServer by Citrix
CVE-2026-23561

9.4CRITICAL

Key Information:

Vendor

Xen Project
Status
Xapi
Vendor
CVE Published:
9 July 2026

What is CVE-2026-23561?

A vulnerability exists in XenServer's Role-Based Access Control (RBAC) system where lower privilege roles can modify critical configurations, leading to severe potential impacts. Administrators with the vm-admin role have been found to manipulate VM configurations such as setting a VM as a storage driver domain, which may result in mismanagement of the host's storage connections. This flaw could leave system domains vulnerable during operations, allowing unauthorized actions that threaten the integrity of the hosting environment.

Affected Version(s)

XAPI all

References

https://xenbits.xen.org/xsa/advisory-489.html

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.