VM administrators are able to set the VM.other‑config:is_system_domain flag, a setting that should be restricted to higher‑privilege pool administrators. When a VM is marked as a system domain it can be hidden from management tools and ignored during certain host or pool operations, providing a stealthy foothold for the attacker. This flaw effectively grants a lower‑privilege administrator the ability to alter system‑critical configurations, potentially leading to denial against the host if the marked VM interferes with normal operation. The weakness constitutes a CWE‑250 \"Privilege‑Controlled Missing or Incorrect Authorization\" vulnerability.

The vulnerability affects Xen XAPI, the role‑based access control component of Xen Server. Users with the vm‑admin role on any Xen Server deployment can exploit the flaw, regardless of the specific Xen version, as the product documentation does not state any version restrictions. No specific version information is provided in the CNA data, so all XAPI installations that include the exposed API call are potentially impacted.

With a CVSS score of 9.4 the vulnerability is considered critical. The EPSS score of < 1 % indicates a low but non‑zero likelihood of exploitation. It is not listed in CISA’s KEV catalog, so no public evidence of active exploitation exists. Based on the description, the attack vector is inferred to be through the XAPI interface, which can be accessed over the management port. Any user with vm‑admin privileges can set the VM.other_config:is_system_domain attribute, effectively designating VMs as system domains that are ignored or hidden by host and pool operations. This grants the attacker privilege escalation and the potential to disrupt host‑level operations.