Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory Swati KhandelwalNov 04, 2026Vulnerability / Cloud Security Two flaws in the Xen hypervisor allow a malicious guest virtual machine (VM) to read and write the memory of other VMs on the same host, including dom0. Dom0 is the VM that, by default, has full permissions and manages the others. Patches are out, and there is no known mitigation, the Xen Project said in an advisory on November 3. All Xen versions from 4.6 onward are vulnerable, while 4.5 and earlier are not. The flaws are tracked as CVE-2026-102703 and CVE-2026-102704, under Xen advisory XSA-523. The Xen Project credited AI company Anthropic with finding the flaws using its Claude model. Stephan Lipp of Ada Logics then validated the finding, and the CodeAnt AI Security Research Team later independently reported the same issue. The flaws are in grant copy, the operation Xen uses to copy data between VMs. Each VM tells Xen which of its memory pages other VMs may use, and Xen checks those permissions. To save time on a batch of copies within the same memory page, Xen reuses checks it has already made. In some cases, it did not check again when it should have. That mistake is what lets a malicious guest read and write memory it does not own. XCP-ng, an open-source virtualization platform built around Xen, said in its update notes that "a single compromised guest can break out of its isolation and take over the whole host." Xen's advisory does not mention any attacks that exploit the flaws or specify what access within the VM an attacker needs. Qubes OS is a security-focused desktop operating system that keeps software in separate Xen-based compartments called qubes. A bulletin said that every supported release and configuration is affected. Its fix is for Qubes 4.3, the only release it still supports. Because every Xen version from 4.6 on is vulnerable, other products built on those versions are affected until their makers add the XSA-523 patches. As of November 4, Debian's security tracker listed the xen package in its bookworm, trixie, and forky releases as vulnerable, and in sid as fixed. Xen source: the advisory has patches for xen-unstable to Xen 4.19.x, and for Xen 4.18.x to 4.17.x. Xen 4.6 to 4.16: the advisory has no patch for these versions. Xen 4.16's security support ended on December 2, 2024. XCP-ng 8.3: xen-4.17.7-4.2.xcpng8.3, released November 3. Hosts must be rebooted. Vates, which backs XCP-ng, rates the impact as Critical. Qubes OS 4.3: Xen packages 4.19.6-3 in dom0. Dom0 must be restarted, and Anti Evil Maid users must reseal their secret passphrase because the new Xen binaries change PCR18 and PCR19. Qubes told users on November 3 to keep installing updates as normal. The fixed packages were then in its security-testing repository, due to move to the stable one over the next two weeks after community testing. XSA-523 is separate from XSA-500, an earlier grant copy flaw that Xen disclosed on July 28, and it has its own patches. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. artificial intelligence, Cloud security, linux, Virtualization Security, Vulnerability Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers AI-Generated Fake Login Pages Are Making Account Takeovers Easier CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Register for Free Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Accelerate Incident Response: 95% Faster Containment Cut containment time from 48 hours to 3. Read the Orchid IR case study. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk Your Attack Surface Is Growing Faster Than Your Team Can Respond Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security