CVE-2026-23560

Name of the Vulnerable Software and Affected Versions XCP-ng (affected versions not specified) XenServer (affected versions not specified) Xen XAPI (affected versions not specified)

Description A role-based access control (RBAC) flaw exists in the Xen XAPI subsystem, specifically within the system domains.ml:30-35() function. The issue stems from improper authorization and insufficient access control regarding sensitive VM configurations. An attacker with vm-admin privileges can manipulate the VM.other-config:is system domain variable to classify a virtual machine as a system domain. This allows the VM to be ignored during certain host or pool operations, effectively hiding it from management tools. Such exploitation can lead to unauthorized privilege escalation to root level, persistence, and evasion of operational controls, allowing unauthorized workloads to survive maintenance actions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.