Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-0941
Vulnerability from certfr_avis - Published: 2026-07-29 - Updated: 2026-07-29
De multiples vulnérabilités ont été découvertes dans Citrix XenServer. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un problème de sécurité non spécifié par l'éditeur.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "XenServer versions 8.4 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "XenServer",
"vendor": {
"name": "Citrix",
"scada": false
}
}
},
{
"description": "XenServer versions 9 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "XenServer",
"vendor": {
"name": "Citrix",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-42492",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42492"
},
{
"name": "CVE-2026-62428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-62428"
},
{
"name": "CVE-2026-62436",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-62436"
},
{
"name": "CVE-2026-62434",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-62434"
},
{
"name": "CVE-2026-62432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-62432"
},
{
"name": "CVE-2026-62435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-62435"
},
{
"name": "CVE-2026-62431",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-62431"
}
],
"initial_release_date": "2026-07-29T00:00:00",
"last_revision_date": "2026-07-29T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0941",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-07-29T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Citrix XenServer. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Citrix XenServer",
"vendor_advisories": [
{
"published_at": "2026-07-28",
"title": "Bulletin de s\u00e9curit\u00e9 Citrix CTX696836",
"url": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696836\u0026articleURL=XenServer_Security_Update_for_Multiple_Issues"
}
]
}
CVE-2026-42492 (GCVE-0-2026-42492)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:31 – Updated: 2026-07-28 16:33
VLAI
EPSS
VEX
Title
vIRQ event channel binding may break Xenstore
Summary
Xenstore, to have an up-to-date picture of the entire system, wants to
know of domains appearing and disappearing. To make this more robust, a
new XEN_DOMCTL_get_domain_state was introduced. The management of the
bitmap underlying that operation is tied into the binding of the
VIRQ_DOM_EXC virtual IRQ. Unfortunately an error path there would tear
down the bitmap even in cases when it wasn't set up. Unprivileged domains
can trigger that error path.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-459 - Incomplete Cleanup
Assigner
References
Date Public
2026-07-28 12:00
Credits
This issue was discovered by Grygorii Strashko of EPAM.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-28T16:33:22.683Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-496.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/13"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-42492",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:56:49.876014Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-459",
"description": "CWE-459 Incomplete Cleanup",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:56:54.437Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-496"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "Xen 4.21 and onwards are vulnerable. Xen 4.20 and older are not\nvulnerable."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Grygorii Strashko of EPAM."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Xenstore, to have an up-to-date picture of the entire system, wants to\nknow of domains appearing and disappearing. To make this more robust, a\nnew XEN_DOMCTL_get_domain_state was introduced. The management of the\nbitmap underlying that operation is tied into the binding of the\nVIRQ_DOM_EXC virtual IRQ. Unfortunately an error path there would tear\ndown the bitmap even in cases when it wasn\u0027t set up. Unprivileged domains\ncan trigger that error path."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An unprivileged domain can affect the operation of Xenstore, potentially\nleading to a Denial of Service (DoS) affecting the entire host. A\nhypervisor crash with similar host wide effect also is possible, albeit\nunlikely."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:31:28.304Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-496.html"
}
],
"title": "vIRQ event channel binding may break Xenstore",
"workarounds": [
{
"lang": "en",
"value": "There is no known mitigation."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-42492",
"datePublished": "2026-07-28T12:31:28.304Z",
"dateReserved": "2026-04-27T14:20:24.139Z",
"dateUpdated": "2026-07-28T16:33:22.683Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62428 (GCVE-0-2026-62428)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 16:33
VLAI
EPSS
VEX
Title
grant-table: type confusion in grant-copy
Summary
When grant-copy operations are processed, the respective grant may or may
not already be in use by another operation (a mapping or another copy).
For all copy operations the referenced guest frame is looked up. When
another operation is already active for the grant (the grant is "pinned"),
what is being supplied back to actually carry out permission checks and
copy operation may not be consistent: The permission check may be carried
out on a page different from the one involved in the copy.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Assigner
References
Date Public
2026-07-28 12:00
Credits
This issue was discovered by Roman S.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-28T16:33:28.183Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-500.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/16"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62428",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:10:28.542416Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:10:53.004Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-500"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.2 onwards are vulnerable. Xen versions 4.1 and\nearlier are not vulnerable.\n\nXen versions 4.13 and newer offer a way to build Xen without grant table\nsupport. Such hypervisors (CONFIG_GRANT_TABLE turned off) are not\nvulnerable."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Roman S."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "When grant-copy operations are processed, the respective grant may or may\nnot already be in use by another operation (a mapping or another copy).\nFor all copy operations the referenced guest frame is looked up. When\nanother operation is already active for the grant (the grant is \"pinned\"),\nwhat is being supplied back to actually carry out permission checks and\ncopy operation may not be consistent: The permission check may be carried\nout on a page different from the one involved in the copy."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An unprivileged guest may be able to elevate its privileges to that of the\nhost. Information leaks and Denial of Service (DoS) are possible as well."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:32:07.573Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-500.html"
}
],
"title": "grant-table: type confusion in grant-copy",
"workarounds": [
{
"lang": "en",
"value": "There is no known mitigation."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62428",
"datePublished": "2026-07-28T12:32:07.573Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T16:33:28.183Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62431 (GCVE-0-2026-62431)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 16:33
VLAI
EPSS
VEX
Title
Viridian STIMER division by zero
Summary
The logic to handle periodic Viridian STIMERs performs a division with an
unchecked user-controlled divisor value, that can be set to zero to cause a #DE
fault.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-369 - Divide By Zero
Assigner
References
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-28T16:33:31.447Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-504.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/20"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62431",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:49:03.810668Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-369",
"description": "CWE-369 Divide By Zero",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:49:09.743Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-504"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.13 onwards are vulnerable. Xen versions 4.12 and\nearlier are not vulnerable.\n\nOnly HVM guests with Viridian STIMERs enabled can trigger the vulnerability."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The logic to handle periodic Viridian STIMERs performs a division with an\nunchecked user-controlled divisor value, that can be set to zero to cause a #DE\nfault."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Enabling Viridian STIMERs to unprivileged HVM guests can result in a Denial\nof Service (DoS) affecting the entire host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:32:43.849Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-504.html"
}
],
"title": "Viridian STIMER division by zero",
"workarounds": [
{
"lang": "en",
"value": "Not enabling Viridian STIMERs for HVM guests will avoid the vulnerability.\n\nNote Viridian extensions are not enabled by default."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62431",
"datePublished": "2026-07-28T12:32:43.849Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T16:33:31.447Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62432 (GCVE-0-2026-62432)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 16:33
VLAI
EPSS
VEX
Title
evtchn: Race between FIFO expand and reset
Summary
The EVTCHNOP_expand_array hypercall checks for whether FIFO event
channels are enabled, but without holding the correct lock. It can race
with EVTCHNOP_reset, resulting in dereferencing a NULL pointer.
Severity
7.3 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-28T16:33:32.509Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-505.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/21"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62432",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:13:34.638706Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:13:39.575Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-505"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.5 onwards are vulnerable. Xen versions 4.4 and\nearlier are not vulnerable."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The EVTCHNOP_expand_array hypercall checks for whether FIFO event\nchannels are enabled, but without holding the correct lock. It can race\nwith EVTCHNOP_reset, resulting in dereferencing a NULL pointer."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A malicious HVM guest (x86 HVM or PVH, and ARM) can crash Xen leading to\na denial of service.\n\nA malicious x86 PV guest can most likely crash Xen leading to a denial\nof service, but memory corruption or privilege escalation cannot be\nruled out."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:32:52.043Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-505.html"
}
],
"title": "evtchn: Race between FIFO expand and reset",
"workarounds": [
{
"lang": "en",
"value": "There are no mitigations."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62432",
"datePublished": "2026-07-28T12:32:52.043Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T16:33:32.509Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62434 (GCVE-0-2026-62434)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:33 – Updated: 2026-07-28 16:33
VLAI
EPSS
VEX
Title
PoD: Don't try to reclaim special pages
Summary
A guest started with Populated on Demand enabled (PoD) can attempt to
reclaim pages which aren't regular guest RAM. This can cause corruption
of memory management state in Xen.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-28T16:33:34.668Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-507.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/23"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62434",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T14:59:52.970334Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:00:00.728Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-507"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 3.4 onwards are vulnerable. Xen versions 3.3 and\nearlier are not vulnerable.\n\nOnly x86 systems are vulnerable.\n\nOnly x86 HVM and PVH guests started in populate-on-demand mode are\nbelieved to be able to leverage the vulnerability. Populate-on-demand\nmode is activated when the guest\u0027s xl configuration file specifies a\n\"maxmem\" value which is larger than the \"memory\" value."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A guest started with Populated on Demand enabled (PoD) can attempt to\nreclaim pages which aren\u0027t regular guest RAM. This can cause corruption\nof memory management state in Xen."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A buggy or malicious guest can cause corruption of Xen\u0027s state, leading\nto crashes or other malfunctions. Information leak and privilege\nescalation cannot be ruled out."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:33:08.540Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-507.html"
}
],
"title": "PoD: Don\u0027t try to reclaim special pages",
"workarounds": [
{
"lang": "en",
"value": "Running only PV guests or HVM/PVH guests without PoD will avoid the\nvulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62434",
"datePublished": "2026-07-28T12:33:08.540Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T16:33:34.668Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62435 (GCVE-0-2026-62435)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 15:19
VLAI
EPSS
VEX
Title
grant-table: version change racing with other operations
Summary
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
With the introduction of Grant Table v2 came the requirement to be able to
switch between versions. Switching from v1 to v2 reduces the number of
valid grant references, as a bigger shared entry structure is then needed
while the shared table doesn't change size. Switching from v2 back to v1
the status frames, which are separate in v2, go away.
Code holding, but intermediately dropping and then re-acquiring the grant
table lock, sometimes wrongly assumes that said properties wouldn't change
across the window in time where the lock is not being held.
The v1 -> v2 issue is CVE-2026-62435.
The v2 -> v1 issue is CVE-2026-62436.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
1 reference
Date Public
2026-07-28 12:00
Credits
This issue was discovered by Mark Esler.
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62435",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:19:26.810813Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:19:30.368Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-501"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.0 onwards are vulnerable. Xen versions 3.4 and\nearlier are not vulnerable.\n\nOnly x86 guests permitted to use grant table version 2 interfaces can\nleverage this vulnerability. On Arm, grant table v2 use is explicitly\nunsupported.\n\nOnly multi-vCPU guests can leverage this vulnerability.\n\nXen versions 4.13 and newer offer a way to build Xen without grant table\nsupport. Such hypervisors (CONFIG_GRANT_TABLE turned off) are not\nvulnerable."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Mark Esler."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nWith the introduction of Grant Table v2 came the requirement to be able to\nswitch between versions. Switching from v1 to v2 reduces the number of\nvalid grant references, as a bigger shared entry structure is then needed\nwhile the shared table doesn\u0027t change size. Switching from v2 back to v1\nthe status frames, which are separate in v2, go away.\n\nCode holding, but intermediately dropping and then re-acquiring the grant\ntable lock, sometimes wrongly assumes that said properties wouldn\u0027t change\nacross the window in time where the lock is not being held.\n\nThe v1 -\u003e v2 issue is CVE-2026-62435.\n\nThe v2 -\u003e v1 issue is CVE-2026-62436."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An unprivileged guest may be able to elevate its privileges to that of the\nhost. Information leaks and Denial of Service (DoS) are possible as well."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:32:16.287Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-501.html"
}
],
"title": "grant-table: version change racing with other operations",
"workarounds": [
{
"lang": "en",
"value": "Using the \"gnttab=max-ver:1\" hypervisor command line option will avoid\nthe vulnerability.\n\nUsing the \"max_grant_version=1\" guest configuration option for guests will\nalso avoid the vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62435",
"datePublished": "2026-07-28T12:32:16.287Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T15:19:30.368Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62436 (GCVE-0-2026-62436)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 15:17
VLAI
EPSS
VEX
Title
grant-table: version change racing with other operations
Summary
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
With the introduction of Grant Table v2 came the requirement to be able to
switch between versions. Switching from v1 to v2 reduces the number of
valid grant references, as a bigger shared entry structure is then needed
while the shared table doesn't change size. Switching from v2 back to v1
the status frames, which are separate in v2, go away.
Code holding, but intermediately dropping and then re-acquiring the grant
table lock, sometimes wrongly assumes that said properties wouldn't change
across the window in time where the lock is not being held.
The v1 -> v2 issue is CVE-2026-62435.
The v2 -> v1 issue is CVE-2026-62436.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
1 reference
Date Public
2026-07-28 12:00
Credits
This issue was discovered by Mark Esler.
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62436",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:16:28.153900Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:17:33.705Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-501"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.0 onwards are vulnerable. Xen versions 3.4 and\nearlier are not vulnerable.\n\nOnly x86 guests permitted to use grant table version 2 interfaces can\nleverage this vulnerability. On Arm, grant table v2 use is explicitly\nunsupported.\n\nOnly multi-vCPU guests can leverage this vulnerability.\n\nXen versions 4.13 and newer offer a way to build Xen without grant table\nsupport. Such hypervisors (CONFIG_GRANT_TABLE turned off) are not\nvulnerable."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Mark Esler."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nWith the introduction of Grant Table v2 came the requirement to be able to\nswitch between versions. Switching from v1 to v2 reduces the number of\nvalid grant references, as a bigger shared entry structure is then needed\nwhile the shared table doesn\u0027t change size. Switching from v2 back to v1\nthe status frames, which are separate in v2, go away.\n\nCode holding, but intermediately dropping and then re-acquiring the grant\ntable lock, sometimes wrongly assumes that said properties wouldn\u0027t change\nacross the window in time where the lock is not being held.\n\nThe v1 -\u003e v2 issue is CVE-2026-62435.\n\nThe v2 -\u003e v1 issue is CVE-2026-62436."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An unprivileged guest may be able to elevate its privileges to that of the\nhost. Information leaks and Denial of Service (DoS) are possible as well."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:32:16.344Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-501.html"
}
],
"title": "grant-table: version change racing with other operations",
"workarounds": [
{
"lang": "en",
"value": "Using the \"gnttab=max-ver:1\" hypervisor command line option will avoid\nthe vulnerability.\n\nUsing the \"max_grant_version=1\" guest configuration option for guests will\nalso avoid the vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62436",
"datePublished": "2026-07-28T12:32:16.344Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T15:17:33.705Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…