Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory
Summary: Two flaws in the Xen hypervisor, tracked as CVE-2026-102703 and CVE-2026-102704 under advisory XSA-523, let a malicious guest VM read and write the memory of other VMs on the same host, including dom0. The Xen Project published patches on November 3 with no known mitigation, and all Xen versions from 4.6 onward are vulnerable while 4.5 and earlier are not.
Why it matters: XCP-ng's update notes state that a single compromised guest can break out of its isolation and take over the whole host, and CodeAnt reported a working guest-to-dom0 escape on XenServer 9 to Xen, scoring both CVEs at 9.3 under CVSS 3.1.
Read the original at The Hacker News ↗
- Topics
- AI Security
- Mentions
- CVE-2026-102703CVE-2026-102704
- Related
- ⚡ Weekly Recap: SSHole Exploited, APT Root RCE, Robot Takeovers, 15K Hacked Sites, and More Cyber Risks ·SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026