# Multiple Vulnerabilities in Citrix XenServer 8.4 and 9 Enable Guest-to-Host Escalation and Denial of Service (CVE-2026-42492, CVE-2026-62428, CVE-2026-62431, CVE-2026-62432, CVE-2026-62434, CVE-2026-62435, CVE-2026-62436)

> HKCERT and CERT-FR advisories cover seven CVEs in Citrix XenServer 8.4 and 9 (unpatched), all traced to underlying Xen Project hypervisor bugs (XSA-496, 500, 501, 504, 505, 507) in Xenstore event-channel handling, grant-table processing, event-channel FIFO logic, Viridian timer emulation, and Populate-on-Demand memory reclaim. Exploitation from an unprivileged guest domain can cause host-wide denial of service, and in the grant-table cases (CVE-2026-62428, CVE-2026-62435, CVE-2026-62436) may allow a guest to escalate privileges to that of the host. Citrix has released hotfixes via CTX696836; no active exploitation or public PoC has been confirmed by either CERT.

- **Published:** 2026-07-31T00:00:00Z
- **Last reviewed:** 2026-07-31T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1781
- **ID:** TL-2026-1781
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-42492, CVE-2026-62428, CVE-2026-62431, CVE-2026-62432, CVE-2026-62434, CVE-2026-62435, CVE-2026-62436

## Description

On 2026-07-28 the Xen Project disclosed six coordinated security advisories (XSA-496, XSA-500, XSA-501, XSA-504, XSA-505, XSA-507) covering seven CVEs that collectively affect Citrix XenServer 8.4 and XenServer 9, both of which ship the vulnerable Xen hypervisor components. Citrix shipped fixes the same day under Security Bulletin CTX696836; CERT-FR (CERTFR-2026-AVI-0941, 2026-07-29) and HKCERT (bulletin 2026-07-30, alert A26-07-53 2026-07-31) subsequently issued consolidated advisories.

CVE-2026-42492 (XSA-496, CVSS 7.5) is an incomplete-cleanup bug (CWE-459) in the binding of the VIRQ_DOM_EXC virtual IRQ used by Xenstore's XEN_DOMCTL_get_domain_state hypercall to track domain appearance/disappearance. An error path tears down the underlying bitmap even when it was never initialized, and an unprivileged domain can trigger this path, breaking Xenstore host-wide (DoS; theoretical hypervisor crash). Affects Xen 4.21 and later.

CVE-2026-62428 (XSA-500, CVSS 7.8, the highest-severity issue in this batch, CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H per NVD) is a time-of-check/time-of-use race (CWE-367) in grant-copy processing. Per the advisory: 'When grant-copy operations are processed, the respective grant may or may not already be in use by another operation. For all copy operations the referenced guest frame is looked up. When another operation is already active for the grant (the grant is "pinned"), what is being supplied back to actually carry out permission checks and copy operation may not be consistent: The permission check may be carried out on a page different from the one involved in the copy' — a type-confusion condition. An unprivileged guest can leverage this for information disclosure, DoS, or full privilege escalation to the host. Affects Xen 4.2 through unstable (excluding 4.1 and earlier, and builds without CONFIG_GRANT_TABLE / grant-table support).

CVE-2026-62431 (XSA-504, CVSS 7.5) is a divide-by-zero (CWE-369) in the periodic Viridian STIMER (synthetic timer) emulation path: the code performs a division using an unchecked, guest-controlled divisor that can be set to zero, triggering a #DE fault and host-wide DoS on HVM guests with Viridian STIMERs enabled (disabled by default). Affects Xen 4.13 and later.

CVE-2026-62432 (XSA-505, CVSS 7.3) is a race condition (CWE-362) between the EVTCHNOP_expand_array hypercall — which 'checks for whether FIFO event channels are enabled, but without holding the correct lock' — and EVTCHNOP_reset. By timing calls to both hypercalls, a guest can force expand_array to dereference memory that reset has already freed, causing a NULL-pointer dereference. HVM guests (x86 HVM, PVH, and Arm variants) can reliably trigger a host crash; for x86 PV guests memory corruption or privilege escalation cannot be ruled out. Affects Xen 4.5 and later.

CVE-2026-62434 (XSA-507, CVSS 5.3) lets a guest started with Populate-on-Demand (PoD, maxmem greater than memory in its xl config) attempt to reclaim special (non-regular-RAM) pages, corrupting Xen's memory-management state (CWE-787, out-of-bounds write); crashes/malfunctions are the primary risk, with information disclosure and privilege escalation not ruled out. Affects x86 HVM/PVH guests on Xen 3.4 and later.

CVE-2026-62435 and CVE-2026-62436 (both XSA-501, CVSS 6.5 each) are companion race conditions (CWE-362) in the grant-table v1<->v2 version-switch path. Code that drops and re-acquires the grant-table lock during the switch wrongly assumes certain properties cannot change during that unsynchronized window: CVE-2026-62435 covers the v1-to-v2 transition (switching to v2 reduces valid grant references, since the shared entry structure grows larger while table size stays constant); CVE-2026-62436 covers the v2-to-v1 transition (reverting to v1 eliminates status frames, which exist separately in v2). Both require x86 guests with grant-table v2 support and multiple vCPUs (Arm does not support grant-table v2), and can lead to guest-to-host privilege escalation, information disclosure, or DoS. Affects Xen 4.0 and later (3.4 and earlier unaffected).

All seven issues require an attacker to already control a guest domain (VM tenant) on the affected hypervisor — they are guest-to-host escalation/DoS bugs triggered via direct hypercall invocation (XEN_DOMCTL_get_domain_state, grant-copy operations, grant-table version-switch calls, EVTCHNOP_expand_array/EVTCHNOP_reset), not remotely-exploitable-from-the-internet flaws. On multi-tenant virtualization and cloud/hosting infrastructure this is nonetheless serious: a malicious or compromised tenant VM could crash the shared host (denial of service to co-tenants) or, for the grant-table CVEs, potentially break out of its VM boundary entirely — matching HKCERT's stated risk categories of denial of service, security restriction bypass, and system tampering, and CERT-FR's characterization of remote arbitrary code execution and DoS risk. Checked against the CISA Known Exploited Vulnerabilities catalog (2026.07.29 build, 1,656 entries) on 2026-07-31: none of the seven CVE IDs are present, corroborating that no active exploitation is confirmed. No public proof-of-concept code has been disclosed by CISA, CERT-FR, HKCERT, Citrix, or the Xen Project as of 2026-07-31.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1592.002 Software
- T1588.006 Vulnerabilities
- T1587.004 Exploits
- T1082 System Information Discovery
- T1518 Software Discovery
- T1106 Native API
- T1068 Exploitation for Privilege Escalation
- T1611 Escape to Host
- T1611 Escape to Host
- T1211 Exploitation for Stealth
- T1005 Data from Local System
- T1499 Endpoint Denial of Service
- T1499.001 OS Exhaustion Flood
- T1499.002 Service Exhaustion Flood
- T1499.004 Application or System Exploitation

## Sources

- [Security Alert A26-07-53: Multiple Vulnerabilities in Citrix Products](https://www.govcert.gov.hk/en/alerts_detail.php?id=1993)
- [HKCERT Security Bulletin: Citrix XenServer Multiple Vulnerabilities](https://www.hkcert.org/security-bulletin/citrix-xenserver-multiple-vulnerabilities_20260730)
- [CERTFR-2026-AVI-0941: Multiples vulnerabilites dans Citrix XenServer](https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0941)
- [Citrix Security Bulletin CTX696836](https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696836)
- [XSA-496: vIRQ event channel binding may break Xenstore](https://xenbits.xenproject.org/xsa/advisory-496.html)
- [XSA-500: grant-table: type confusion in grant-copy](https://xenbits.xenproject.org/xsa/advisory-500.html)
- [XSA-501: grant-table: version change racing with other operations](https://xenbits.xenproject.org/xsa/advisory-501.html)
- [XSA-504: Viridian STIMER division by zero](https://xenbits.xenproject.org/xsa/advisory-504.html)
- [XSA-505: evtchn: Race between FIFO expand and reset](https://xenbits.xenproject.org/xsa/advisory-505.html)
- [XSA-507: PoD: Don't try to reclaim special pages](https://xenbits.xenproject.org/xsa/advisory-507.html)
- [NVD - CVE-2026-42492 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-42492)
- [NVD - CVE-2026-62428 Detail (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, CWE-367)](https://nvd.nist.gov/vuln/detail/CVE-2026-62428)
- [CISA Known Exploited Vulnerabilities Catalog (checked 2026-07-31, no matches for the seven CVEs)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [runZero: Citrix Hypervisor vulnerabilities - how to find affected assets](https://www.runzero.com/blog/citrix-xenserver-hypervisor/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1781