Multiple Critical Vulnerabilities Discovered in Xen Affecting Data Confidentiality and Security Policies
Multiple security vulnerabilities have been identified in several versions of Xen and its XAPI master component, enabling attackers to escalate privileges, breach data confidentiality, and bypass security policies. These flaws affect Xen versions prior to various released patches (notably XSA-524 through XSA-532) spanning versions 4.17.x to 4.21.x, and all versions of XAPI master without the latest security updates. The vulnerabilities are collectively tracked under several CVE identifiers, including CVE-2024-21963 and CVE-2026-119780, among others. Xen's security advisories from November 10, 2026, provide patches that address these issues, highlighting the importance for users to apply them promptly to mitigate risks associated with privilege elevation and data confidentiality compromises.
Entenda a falha
A vulnerabilidade
Xen and its XAPI master component have multiple vulnerabilities, tracked as CVE-2024-21963, CVE-2024-36350, CVE-2024-36357, CVE-2026-0004, CVE-2026-102705 to CVE-2026-102708, CVE-2026-119779, CVE-2026-119780, CVE-2026-99286 and CVE-2026-99287. According to CERT-FR, some of them allow privilege escalation, a breach of data confidentiality or a bypass of the security policy. The sources do not say which impact belongs to which CVE, nor what access an attacker needs. Affected: Xen 4.17.x through 4.21.x without the latest patch, Xen for Linux before the xsa532-linux.patch fix, and all XAPI master versions without the latest security update. The sources give no CVSS scores.
Onde está
The sources name no file or function. The fixes are in Xen advisories XSA-524, 525, 529, 530, 531 and 532 (xenbits.xen.org/xsa), which include patch files such as xsa524.patch and xsa532-linux.patch.
Como foi descoberta
The sources do not say who found the flaws or how. The Xen project published the advisories on November 10, 2026, and CERT-FR issued its notice (CERTFR-2026-AVI-1508) on November 12, 2026, pointing to the vendor advisories for the fixes.
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 13:33.
Linha do tempo
-
Multiple Critical Vulnerabilities Discovered in Xen Affecting Data Confidentiality and Security Policies
ler a análise desta fonte ocultar
Multiple security vulnerabilities have been identified in several versions of Xen and its XAPI master component, enabling attackers to escalate privileges, breach data confidentiality, and bypass security policies. These flaws affect Xen versions prior to various released patches (notably XSA-524 through XSA-532) spanning versions 4.17.x to 4.21.x, and all versions of XAPI master without the latest security updates. The vulnerabilities are collectively tracked under several CVE identifiers, including CVE-2024-21963 and CVE-2026-119780, among others. Xen's security advisories from November 10, 2026, provide patches that address these issues, highlighting the importance for users to apply them promptly to mitigate risks associated with privilege elevation and data confidentiality compromises.