Role-Based Access Control Flaw in XenServer by Citrix
CVE-2026-23562

9.4CRITICAL

Key Information:

Vendor

Xen Project
Status
Xapi
Vendor
CVE Published:
9 July 2026

What is CVE-2026-23562?

A misconfiguration in the Role-Based Access Control of XenServer allows users with lower privileges, such as vm-admin, to access PCI passthrough functionality. This access can lead to unintended control over host hardware, compromising system integrity and security. Under normal circumstances, such configurations should be restricted to the fully privileged pool-admin role. The oversight creates a potential path for privilege escalation and unauthorized hardware manipulation.

Affected Version(s)

XAPI all

References

https://xenbits.xen.org/xsa/advisory-489.html

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.