Threat reportVulnerabilityTL-2026-1781

Multiple Vulnerabilities in Citrix XenServer 8.4 and 9 Enable Guest-to-Host Escalation and Denial of Service (CVE-2026-42492, CVE-2026-62428, CVE-2026-62431, CVE-2026-62432, CVE-2026-62434, CVE-2026-62435, CVE-2026-62436)

highACTIVE

Multiple Vulnerabilities in Citrix XenServer 8.4 and 9 (TL-2026-1781), also tracked as XSA-496, is a high-severity software vulnerability scored CVSS 7.8, first published 2026-07-31. It has no confirmed attribution, affects Citrix XenServer, references 7 CVEs (CVE-2026-42492, CVE-2026-62428, CVE-2026-62431), maps to 15 MITRE ATT&CK techniques (T1005, T1068, T1082), and is covered by 9 detection rules and 24 indicators of compromise.

CVSS
7.8/10High
CVEs
7Referenced vulnerabilities
Techniques
15MITRE ATT&CK
Actors
0Not attributed
Detection rules
9SPL · KQL · Sigma
IOCs
24Indicators of compromise

Key facts for TL-2026-1781

Threat ID
TL-2026-1781
Also known as
XSA-496, XSA-500, XSA-501, XSA-504, XSA-505, XSA-507
Severity
HIGH
CVSS
7.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
Last reviewed
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, financial services, health, technology, telecoms, cloud hosting, managed service providers, critical infrastructure
Target regions
Global, Asia-Pacific, Europe
Detection rules
9
Indicators of compromise
24

How Multiple Vulnerabilities in Citrix XenServer 8.4 and 9 works

HKCERT and CERT-FR advisories cover seven CVEs in Citrix XenServer 8.4 and 9 (unpatched), all traced to underlying Xen Project hypervisor bugs (XSA-496, 500, 501, 504, 505, 507) in Xenstore event-channel handling, grant-table processing, event-channel FIFO logic, Viridian timer emulation, and Populate-on-Demand memory reclaim. Exploitation from an unprivileged guest domain can cause host-wide denial of service, and in the grant-table cases (CVE-2026-62428, CVE-2026-62435, CVE-2026-62436) may allow a guest to escalate privileges to that of the host. Citrix has released hotfixes via CTX696836; no active exploitation or public PoC has been confirmed by either CERT.

On 2026-07-28 the Xen Project disclosed six coordinated security advisories (XSA-496, XSA-500, XSA-501, XSA-504, XSA-505, XSA-507) covering seven CVEs that collectively affect Citrix XenServer 8.4 and XenServer 9, both of which ship the vulnerable Xen hypervisor components. Citrix shipped fixes the same day under Security Bulletin CTX696836; CERT-FR (CERTFR-2026-AVI-0941, 2026-07-29) and HKCERT (bulletin 2026-07-30, alert A26-07-53 2026-07-31) subsequently issued consolidated advisories.

CVE-2026-42492 (XSA-496, CVSS 7.5) is an incomplete-cleanup bug (CWE-459) in the binding of the VIRQ_DOM_EXC virtual IRQ used by Xenstore's XEN_DOMCTL_get_domain_state hypercall to track domain appearance/disappearance. An error path tears down the underlying bitmap even when it was never initialized, and an unprivileged domain can trigger this path, breaking Xenstore host-wide (DoS; theoretical hypervisor crash). Affects Xen 4.21 and later.

CVE-2026-62428 (XSA-500, CVSS 7.8, the highest-severity issue in this batch, CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H per NVD) is a time-of-check/time-of-use race (CWE-367) in grant-copy processing. Per the advisory: 'When grant-copy operations are processed, the respective grant may or may not already be in use by another operation. For all copy operations the referenced guest frame is looked up. When another operation is already active for the grant (the grant is "pinned"), what is being supplied back to actually carry out permission checks and copy operation may not be consistent: The permission check may be carried out on a page different from the one involved in the copy' — a type-confusion condition. An unprivileged guest can leverage this for information disclosure, DoS, or full privilege escalation to the host. Affects Xen 4.2 through unstable (excluding 4.1 and earlier, and builds without CONFIG_GRANT_TABLE / grant-table support).

CVE-2026-62431 (XSA-504, CVSS 7.5) is a divide-by-zero (CWE-369) in the periodic Viridian STIMER (synthetic timer) emulation path: the code performs a division using an unchecked, guest-controlled divisor that can be set to zero, triggering a #DE fault and host-wide DoS on HVM guests with Viridian STIMERs enabled (disabled by default). Affects Xen 4.13 and later.

CVE-2026-62432 (XSA-505, CVSS 7.3) is a race condition (CWE-362) between the EVTCHNOP_expand_array hypercall — which 'checks for whether FIFO event channels are enabled, but without holding the correct lock' — and EVTCHNOP_reset. By timing calls to both hypercalls, a guest can force expand_array to dereference memory that reset has already freed, causing a NULL-pointer dereference. HVM guests (x86 HVM, PVH, and Arm variants) can reliably trigger a host crash; for x86 PV guests memory corruption or privilege escalation cannot be ruled out. Affects Xen 4.5 and later.

CVE-2026-62434 (XSA-507, CVSS 5.3) lets a guest started with Populate-on-Demand (PoD, maxmem greater than memory in its xl config) attempt to reclaim special (non-regular-RAM) pages, corrupting Xen's memory-management state (CWE-787, out-of-bounds write); crashes/malfunctions are the primary risk, with information disclosure and privilege escalation not ruled out. Affects x86 HVM/PVH guests on Xen 3.4 and later.

CVE-2026-62435 and CVE-2026-62436 (both XSA-501, CVSS 6.5 each) are companion race conditions (CWE-362) in the grant-table v1<->v2 version-switch path. Code that drops and re-acquires the grant-table lock during the switch wrongly assumes certain properties cannot change during that unsynchronized window: CVE-2026-62435 covers the v1-to-v2 transition (switching to v2 reduces valid grant references, since the shared entry structure grows larger while table size stays constant); CVE-2026-62436 covers the v2-to-v1 transition (reverting to v1 eliminates status frames, which exist separately in v2). Both require x86 guests with grant-table v2 support and multiple vCPUs (Arm does not support grant-table v2), and can lead to guest-to-host privilege escalation, information disclosure, or DoS. Affects Xen 4.0 and later (3.4 and earlier unaffected).

All seven issues require an attacker to already control a guest domain (VM tenant) on the affected hypervisor — they are guest-to-host escalation/DoS bugs triggered via direct hypercall invocation (XEN_DOMCTL_get_domain_state, grant-copy operations, grant-table version-switch calls, EVTCHNOP_expand_array/EVTCHNOP_reset), not remotely-exploitable-from-the-internet flaws. On multi-tenant virtualization and cloud/hosting infrastructure this is nonetheless serious: a malicious or compromised tenant VM could crash the shared host (denial of service to co-tenants) or, for the grant-table CVEs, potentially break out of its VM boundary entirely — matching HKCERT's stated risk categories of denial of service, security restriction bypass, and system tampering, and CERT-FR's characterization of remote arbitrary code execution and DoS risk. Checked against the CISA Known Exploited Vulnerabilities catalog (2026.07.29 build, 1,656 entries) on 2026-07-31: none of the seven CVE IDs are present, corroborating that no active exploitation is confirmed. No public proof-of-concept code has been disclosed by CISA, CERT-FR, HKCERT, Citrix, or the Xen Project as of 2026-07-31.

MITRE ATT&CK techniques used in TL-2026-1781

Collection

T1005 Data from Local System

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1611 Escape to Host

Discovery

T1082 System Information Discovery; T1518 Software Discovery

Execution

T1106 Native API

Defense Evasion

T1211 Exploitation for Stealth

Impact

T1499 Endpoint Denial of Service; T1499.001 OS Exhaustion Flood; T1499.002 Service Exhaustion Flood; T1499.004 Application or System Exploitation

Resource Development

T1587.004 Exploits; T1588.006 Vulnerabilities

Reconnaissance

T1592.002 Software; T1595.002 Vulnerability Scanning

privilege-escalation

T1611 Escape to Host

Affected products and versions in Multiple Vulnerabilities in Citrix XenServer 8.4 and 9

  • Citrix — XenServer
    Vulnerable versions: 8.4 (without the 2026-07-28 security patch); 9 (without the 2026-07-28 security patch)
    Fixed in: 8.4 with CTX696836 hotfixes applied; 9 with CTX696836 hotfixes applied
  • Xen Project — Xen Hypervisor
    Vulnerable versions: 4.21.x and later (CVE-2026-42492 / XSA-496); 4.2 through unstable, excluding 4.1 and earlier, and builds without CONFIG_GRANT_TABLE (CVE-2026-62428 / XSA-500); 4.0 through unstable, excluding 3.4 and earlier (CVE-2026-62435, CVE-2026-62436 / XSA-501); 4.13 and later (CVE-2026-62431 / XSA-504); 4.5 and later, excluding 4.4 and earlier (CVE-2026-62432 / XSA-505); 3.4 and later, x86 HVM/PVH guests only (CVE-2026-62434 / XSA-507)
    Fixed in: Patched via xsa496.patch, xsa500.patch/xsa500-4.17.patch, xsa501.patch/xsa501-4.18.patch/xsa501-4.17.patch, xsa504.patch, xsa505.patch, xsa507.patch

Remediation for Multiple Vulnerabilities in Citrix XenServer 8.4 and 9

Patches

  • Citrix Security Bulletin CTX696836 (XenServer 8.4 and 9 hotfixes, released 2026-07-28)
  • Xen Project XSA-496 patch (xsa496.patch) for CVE-2026-42492
  • Xen Project XSA-500 patches (xsa500.patch for 4.18.x/unstable, xsa500-4.17.patch for 4.17.x) for CVE-2026-62428
  • Xen Project XSA-501 patches (xsa501.patch for 4.19.x/unstable, xsa501-4.18.patch, xsa501-4.17.patch) for CVE-2026-62435 and CVE-2026-62436
  • Xen Project XSA-504 patch (xsa504.patch for 4.17.x) for CVE-2026-62431
  • Xen Project XSA-505 patch (xsa505.patch for 4.17.x/unstable) for CVE-2026-62432
  • Xen Project XSA-507 patch (xsa507.patch for unstable through 4.17.x) for CVE-2026-62434

Immediate actions

  • Apply the Citrix XenServer 8.4 and 9 hotfixes referenced in Security Bulletin CTX696836 as soon as a maintenance window allows
  • For independently-managed Xen Project hypervisor hosts (non-Citrix), apply xsa496.patch, xsa500.patch/xsa500-4.17.patch, xsa501.patch/xsa501-4.18.patch/xsa501-4.17.patch, xsa504.patch, xsa505.patch, and xsa507.patch as applicable to the running Xen version
  • Inventory all XenServer/Xen-based hypervisor hosts and confirm patch level before assuming coverage; there is no single umbrella CVE covering all seven issues
  • Where CVE-2026-62435/CVE-2026-62436 cannot be patched immediately, set the hypervisor boot option gnttab=max-ver:1 (or per-guest max_grant_version=1) to disable the vulnerable v1<->v2 transition path
  • Confirm Viridian STIMER emulation remains disabled (its default state) on HVM guests as an interim mitigation for CVE-2026-62431

Workarounds

  • gnttab=max-ver:1 (hypervisor boot option) mitigates CVE-2026-62435 and CVE-2026-62436 by preventing grant-table v2 usage
  • max_grant_version=1 (per-guest configuration parameter) provides the same mitigation at the guest level
  • Leave Viridian STIMER emulation disabled for HVM guests (default-off) to avoid CVE-2026-62431
  • Run only PV guests, or HVM/PVH guests without Populate-on-Demand (PoD) / with maxmem equal to memory, to avoid CVE-2026-62434
  • No workaround exists for CVE-2026-42492, CVE-2026-62428, or CVE-2026-62432 — patching is the only remediation

Longer-term hardening

  • Establish a recurring Xen Security Advisory (XSA) monitoring/subscription process for all XenServer and Xen Project-based hypervisor fleets, independent of Citrix's own bulletin cadence
  • Segment and minimize the number of untrusted or lower-trust tenant guests co-located on shared virtualization hosts to reduce guest-to-host escalation blast radius
  • Track hypervisor patch compliance as a fleet-wide asset-inventory metric (e.g., via passive asset discovery tooling) rather than relying on per-host manual verification
  • Review whether Populate-on-Demand (PoD) is required for HVM/PVH guest configurations; disable it where not operationally necessary

CVEs associated with Multiple Vulnerabilities in Citrix XenServer 8.4 and 9

CVE-2026-42492, CVE-2026-62428, CVE-2026-62431, CVE-2026-62432, CVE-2026-62434, CVE-2026-62435, CVE-2026-62436

Weaknesses (CWE) in Multiple Vulnerabilities in Citrix XenServer 8.4 and 9

CWE-459, CWE-367, CWE-369, CWE-362, CWE-787

Timeline of Multiple Vulnerabilities in Citrix XenServer 8.4 and 9

  • Citrix publishes Security Bulletin CTX696836, releasing XenServer 8.4 and 9 hotfixes addressing all seven CVEs.
  • Xen Project publishes XSA-507 disclosing CVE-2026-62434, a Populate-on-Demand special-page reclaim bug that corrupts hypervisor memory-management state.
  • Xen Project publishes XSA-505 disclosing CVE-2026-62432, a race between EVTCHNOP_expand_array (unlocked FIFO-enabled check) and EVTCHNOP_reset causing a NULL-pointer-dereference host crash.
  • Xen Project publishes XSA-504 disclosing CVE-2026-62431, a Viridian STIMER divide-by-zero causing host-wide denial of service on affected HVM guests.
  • Xen Project publishes XSA-501 disclosing CVE-2026-62435 and CVE-2026-62436, grant-table v1<->v2 version-switch race conditions enabling privilege escalation and information disclosure.
  • Xen Project publishes XSA-500 disclosing CVE-2026-62428, a grant-copy type-confusion TOCTOU flaw allowing guest-to-host privilege escalation, information disclosure, or DoS.
  • Xen Project publishes XSA-496 disclosing CVE-2026-42492 (VIRQ_DOM_EXC bitmap teardown allowing an unprivileged domain to break Xenstore host-wide).
  • CERT-FR publishes CERTFR-2026-AVI-0941, warning of remote arbitrary code execution and denial-of-service risk in unpatched XenServer 8.4/9 deployments.
  • HKCERT publishes a security bulletin summarizing the Citrix XenServer multiple-vulnerabilities disclosure.
  • TL-Intel Harness ingests the HKCERT advisory via RSS hunt and opens threat TL-2026-1781 for research.
  • Cross-check against the CISA Known Exploited Vulnerabilities catalog (2026.07.29 build) confirms none of the seven CVEs are listed as actively exploited.
  • HKCERT/govcert.gov.hk issues Security Alert A26-07-53 consolidating the seven-CVE disclosure and urging immediate patching.

Sources cited for Multiple Vulnerabilities in Citrix XenServer 8.4 and 9

Detection coverage for TL-2026-1781

As of 2026-07-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1781 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
24 indicators of compromise · Red and above. Compare plans

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats