Improper access control in XenAPI Server - CVE-2026-23560
Published: April 29, 2026
Vulnerability identifier: #VU128447
CSH Severity: Low
CVSS v4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-23560
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to improper access control in VM.other-config:is_system_domain when modifying VM configuration. A remote user can mark a VM as a system domain to escalate privileges.
System domains may be ignored and left running during certain host or pool operations, and may be hidden from view in tooling.
Affected software
XenAPI Server
Citrix XenServer
Citrix XenServer
How to mitigate CVE-2026-23560
Install security update from vendor's website.