EUVD-2026-42603

🗓️ 09 Jul 2026 15:12:00Reported by EUVDType

RBAC enables vm-admin to modify dom0 files and set storage domains; pool-admin has full privileges.

Reporter	Title	Published	Views	Family All 60
ATTACKERKB	CVE-2026-23560	9 Jul 202615:12	–	attackerkb
ATTACKERKB	CVE-2026-23561	9 Jul 202615:13	–	attackerkb
ATTACKERKB	CVE-2026-23559	9 Jul 202615:09	–	attackerkb
ATTACKERKB	CVE-2026-42486	9 Jul 202615:16	–	attackerkb
ATTACKERKB	CVE-2026-23562	9 Jul 202615:15	–	attackerkb
BDU FSTEC	The vulnerability of the setother_config() function in the RBAC access control subsystem of the XCP-ng supervisor and the XenServer server virtualization platform allows a malicious individual to gain unauthorized access to the file system.	20 May 202600:00	–	bdu_fstec
BDU FSTEC	Vulnerability of function system_domains.ml:30-35() in the RBAC access role management subsystem of the XCP-ng hypervisor and XenServer server virtualization platform, which allows a perpetrator to increase their privileges	20 May 202600:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the storage_driver_domain driver in the Role-Based Access Control (RBAC) subsystem of the XCP-ng hypervisor and the XenServer server virtualization platform allows a perpetrator to increase their privileges.	20 May 202600:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the map_keys_roles() function in the RBAC role management subsystem of the XCP-ng hypervisor and the XenServer server virtualization platform allows a perpetrator to bypass existing security mechanisms.	20 May 202600:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the hvm_serial component in the Role-Based Access Control (RBAC) access management subsystem of the XCP-ng hypervisor and the XenServer server virtualization platform allows a perpetrator to gain write access to arbitrary files.	20 May 202600:00	–	bdu_fstec

[
  {
    "enisaIdVendor": [
      {
        "id": "ad3b568b-9a44-308d-9400-a4ecc7475ac7",
        "vendor": {
          "name": "Xen"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "a27a345d-3d46-37cf-bd97-65f770e219fc",
        "product": {
          "name": "Xapi",
          "vendor": {
            "name": "Xapi"
          }
        },
        "product_version": "all"
      }
    ]
  }
]

Source	Link
xenbits	www.xenbits.xen.org/xsa/advisory-489.html

09 Jul 2026 16:08Current

7.3High risk

Vulners AI Score7.3

CVSS 49.4

EPSS0.0014

SSVC