CVE‑2026‑23559 allows a user with the vm‑admin role to set the VBD.other_config:backend‑local flag, turning arbitrary files in the host domain into virtual disks that can be attached to a VM under the attacker's control. This effectively provides read and write access to any file on the host, allowing critical system configuration or sensitive data to be exfiltrated or modified. The related CVEs expand the scope of the privilege misuse to system domain marking, storage domain mis‑configuration, unexpected PCI passthrough access, and a serial port device that should be restricted to full‑admin users. The weakness is a classic elevation of privilege flaw (CWE‑250) wherein lower‑privileged administrative roles are granted higher‑level capabilities.

The vulnerability resides in Xen XAPI’s role‑based access control system. Any installation of XAPI that assigns users the vm‑admin role without further restrictions is potentially impacted; all supported XenServer releases that provide these roles are affected until patched by the vendor.

The CVSS score of 9.4 indicates critical severity. The EPSS score is < 1%, indicating a very low but nonzero exploitation probability, yet the vulnerability could still be widely exploitable given its nature. The flaw is not listed in CISA KEV catalog, yet it remains a high‑risk privilege escalation exploit. A likely attack vector is via an authenticated XAPI API call from a user possessing the vm‑admin role; this is inferred from the documented API usage.