{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23561", "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "state": "PUBLISHED", "assignerShortName": "XEN", "dateReserved": "2026-01-14T13:07:36.961Z", "datePublished": "2026-07-09T15:13:22.160Z", "dateUpdated": "2026-07-09T16:08:43.244Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "shortName": "XEN", "dateUpdated": "2026-07-09T15:13:50.370Z"}, "title": "Multiple RBAC issues in XAPI", "datePublic": "2026-04-28T18:05:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-250", "description": "CWE-250 Execution with unnecessary privileges", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "affected": [{"vendor": "Xen", "product": "XAPI", "versions": [{"status": "affected", "version": "all"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]\nXAPI can configure different users with different roles, using Role\nBased Access Control. For more details, see:\n\n https://docs.xenserver.com/en-us/xencenter/current-release/rbac-overview.html#rbac-roles\n\nThe pool-admin role is fully privileged. Notably, users with this role\ncan also SSH into the host as root.\n\nThe other administrator roles are pool-operator, vm-power-admin and\nvm-admin, each of which are authorised to configure and manage various\naspects of the system.\n\nSome settings are inadequately restricted, and can be set by a lower\nprivilege of administrator than expected.\n\n * CVE-2026-23559: A vm-admin can set VBD.other_config:backend-local and\n turn arbitrary files in dom0 into VDIs (virtual disks) and give said\n disks to a VM they control. This is an arbitrary read and/or modify\n of files in dom0.\n\n * CVE-2026-23560: A vm-admin can set VM.other-config:is_system_domain\n and mark a VM as a system domain. System domains are ignored and\n left running during certain other host/pool operations, and may be\n hidden from view in tooling.\n\n * CVE-2026-23561: A vm-admin can set VM.other_config:storage_driver_domain\n and mark a VM as the storage domain for a particular host storage\n connection (PBD). Shutting down the VM can cause the PBD to be\n erroneously marked as unplugged when it is not.\n\n * CVE-2026-23562: Configuration of PCI passthrough is normally\n restricted to the pool-admin role. However one API was missing this\n check, allowing a vm-admin access to unintended host hardware.\n\n * CVE-2026-42486: A vm-admin can set the VM.platform:hvm_serial\n parameter, which should be restricted to the pool-admin role, as it\n can allow arbitrary dom0 file write.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]<br>XAPI can configure different users with different roles, using Role<br>Based Access Control. For more details, see:<br><br> https://docs.xenserver.com/en-us/xencenter/current-release/rbac-overview.html#rbac-roles<br><br>The pool-admin role is fully privileged. Notably, users with this role<br>can also SSH into the host as root.<br><br>The other administrator roles are pool-operator, vm-power-admin and<br>vm-admin, each of which are authorised to configure and manage various<br>aspects of the system.<br><br>Some settings are inadequately restricted, and can be set by a lower<br>privilege of administrator than expected.<br><br> * CVE-2026-23559: A vm-admin can set VBD.other_config:backend-local and<br> turn arbitrary files in dom0 into VDIs (virtual disks) and give said<br> disks to a VM they control. This is an arbitrary read and/or modify<br> of files in dom0.<br><br> * CVE-2026-23560: A vm-admin can set VM.other-config:is_system_domain<br> and mark a VM as a system domain. System domains are ignored and<br> left running during certain other host/pool operations, and may be<br> hidden from view in tooling.<br><br> * CVE-2026-23561: A vm-admin can set VM.other_config:storage_driver_domain<br> and mark a VM as the storage domain for a particular host storage<br> connection (PBD). Shutting down the VM can cause the PBD to be<br> erroneously marked as unplugged when it is not.<br><br> * CVE-2026-23562: Configuration of PCI passthrough is normally<br> restricted to the pool-admin role. However one API was missing this<br> check, allowing a vm-admin access to unintended host hardware.<br><br> * CVE-2026-42486: A vm-admin can set the VM.platform:hvm_serial<br> parameter, which should be restricted to the pool-admin role, as it<br> can allow arbitrary dom0 file write."}]}], "references": [{"url": "https://xenbits.xen.org/xsa/advisory-489.html"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.4, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-09T16:08:36.337261Z", "id": "CVE-2026-23561", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T16:08:43.244Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23561", "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "state": "PUBLISHED", "assignerShortName": "XEN", "dateReserved": "2026-01-14T13:07:36.961Z", "datePublished": "2026-07-09T15:13:22.160Z", "dateUpdated": "2026-07-09T16:08:43.244Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "shortName": "XEN", "dateUpdated": "2026-07-09T15:13:50.370Z"}, "title": "Multiple RBAC issues in XAPI", "datePublic": "2026-04-28T18:05:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-250", "description": "CWE-250 Execution with unnecessary privileges", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-233", "descriptions": [{"lang": "en", "value": "CAPEC-233 Privilege Escalation"}]}], "affected": [{"vendor": "Xen", "product": "XAPI", "versions": [{"status": "affected", "version": "all"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]\nXAPI can configure different users with different roles, using Role\nBased Access Control. For more details, see:\n\n https://docs.xenserver.com/en-us/xencenter/current-release/rbac-overview.html#rbac-roles\n\nThe pool-admin role is fully privileged. Notably, users with this role\ncan also SSH into the host as root.\n\nThe other administrator roles are pool-operator, vm-power-admin and\nvm-admin, each of which are authorised to configure and manage various\naspects of the system.\n\nSome settings are inadequately restricted, and can be set by a lower\nprivilege of administrator than expected.\n\n * CVE-2026-23559: A vm-admin can set VBD.other_config:backend-local and\n turn arbitrary files in dom0 into VDIs (virtual disks) and give said\n disks to a VM they control. This is an arbitrary read and/or modify\n of files in dom0.\n\n * CVE-2026-23560: A vm-admin can set VM.other-config:is_system_domain\n and mark a VM as a system domain. System domains are ignored and\n left running during certain other host/pool operations, and may be\n hidden from view in tooling.\n\n * CVE-2026-23561: A vm-admin can set VM.other_config:storage_driver_domain\n and mark a VM as the storage domain for a particular host storage\n connection (PBD). Shutting down the VM can cause the PBD to be\n erroneously marked as unplugged when it is not.\n\n * CVE-2026-23562: Configuration of PCI passthrough is normally\n restricted to the pool-admin role. However one API was missing this\n check, allowing a vm-admin access to unintended host hardware.\n\n * CVE-2026-42486: A vm-admin can set the VM.platform:hvm_serial\n parameter, which should be restricted to the pool-admin role, as it\n can allow arbitrary dom0 file write.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]<br>XAPI can configure different users with different roles, using Role<br>Based Access Control. For more details, see:<br><br> https://docs.xenserver.com/en-us/xencenter/current-release/rbac-overview.html#rbac-roles<br><br>The pool-admin role is fully privileged. Notably, users with this role<br>can also SSH into the host as root.<br><br>The other administrator roles are pool-operator, vm-power-admin and<br>vm-admin, each of which are authorised to configure and manage various<br>aspects of the system.<br><br>Some settings are inadequately restricted, and can be set by a lower<br>privilege of administrator than expected.<br><br> * CVE-2026-23559: A vm-admin can set VBD.other_config:backend-local and<br> turn arbitrary files in dom0 into VDIs (virtual disks) and give said<br> disks to a VM they control. This is an arbitrary read and/or modify<br> of files in dom0.<br><br> * CVE-2026-23560: A vm-admin can set VM.other-config:is_system_domain<br> and mark a VM as a system domain. System domains are ignored and<br> left running during certain other host/pool operations, and may be<br> hidden from view in tooling.<br><br> * CVE-2026-23561: A vm-admin can set VM.other_config:storage_driver_domain<br> and mark a VM as the storage domain for a particular host storage<br> connection (PBD). Shutting down the VM can cause the PBD to be<br> erroneously marked as unplugged when it is not.<br><br> * CVE-2026-23562: Configuration of PCI passthrough is normally<br> restricted to the pool-admin role. However one API was missing this<br> check, allowing a vm-admin access to unintended host hardware.<br><br> * CVE-2026-42486: A vm-admin can set the VM.platform:hvm_serial<br> parameter, which should be restricted to the pool-admin role, as it<br> can allow arbitrary dom0 file write."}]}], "references": [{"url": "https://xenbits.xen.org/xsa/advisory-489.html"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.4, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23561", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-09T16:08:36.337261Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T16:08:39.884Z"}}]}}

{}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "XAPI", "source": "cna", "vendor": "Xen"}, "product": "xapi", "vendor": "xen"}], "created": "2026-07-09T16:30:05.885219+00:00", "updated": "2026-07-09T16:30:05.885239+00:00", "vendors": ["xen", "xen$PRODUCT$xapi"]}