Xcp Ng
Security incidents tagged Xcp Ng. Newest first.
1 Xcp Ng incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 0
- Days without an incident
- 0
- Longest quiet run: 1 day (Nov 4–Nov 4)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
- CriticalPartly patched
Xen XSA-523: malicious guest can read and write any VM's memory, including dom0, via grant copy (CVE-2026-102703, CVE-2026-102704)
Two flaws in the Xen hypervisor's grant copy operation let a malicious guest VM read and write arbitrary memory belonging to other domains, including dom0, breaking VM isolation on the host. Xen caches already-validated data during batches of grant copies on the same page, but re-validated it incorrectly: frame numbers and grant references could be mixed up (CVE-2026-102703), and the check limiting copy-by-frame-number to the caller's own memory was misplaced (CVE-2026-102704). Every Xen version from 4.6 onward is vulnerable and there is no mitigation. The Xen Project published patches for xen-unstable through 4.17.x on Nov 3 2026; XCP-ng 8.3 and Qubes OS 4.3 shipped fixed packages that need a host or dom0 reboot, while Debian stable releases were still listed as vulnerable on Nov 4. Found by Anthropic using Claude and validated by Ada Logics; no exploitation has been reported.
Xen hypervisor (and XCP-ng, Qubes OS and other Xen-based platforms)Since Nov 3, 2026
