Xen vulnerabilities & exploitation

Exploitation timeline

Threadlinqs has recorded 7 Xen CVEs published between 2026-07-15 and 2026-07-15. The busiest month was 2026-07 (7 new CVEs). None of them is listed in CISA KEV yet.

Most exploited vulnerabilities

Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 7 of 7 tracked Xen CVEs.

• CVE-2026-42492high 7.5EPSS 0.5%2026-07-28
• CVE-2026-62434medium 5.3EPSS 0.4%2026-07-28
• CVE-2026-62431high 7.5EPSS 0.4%2026-07-28
• CVE-2026-62432high 7.3EPSS 0.2%2026-07-28
• CVE-2026-62435medium 6.5EPSS 0.2%2026-07-28
• CVE-2026-62436medium 6.5EPSS 0.2%2026-07-28
• CVE-2026-62428high 7.8EPSS 0.1%2026-07-28

Products affected

Threadlinqs normalises CPE and CNA product records across all 7 CVEs; 1 distinct Xen product is affected. The most frequently affected:

• Xen 7 CVEs

Threat activity

1 tracked threat campaign reference Xen products or exploit Xen CVEs:

• Multiple Vulnerabilities in Citrix XenServer 8.4 and 9 Enable Guest-to-Host Escalation and Denial of Service (CVE-2026-42492, CVE-2026-62428, CVE-2026-62431, CVE-2026-62432, CVE-2026-62434, CVE-2026-62435, CVE-2026-62436)HIGH2026-07-31

How to prioritise Xen patching

This order follows the data Threadlinqs holds for Xen, not a generic severity checklist:

• No Xen CVE is in CISA KEV yet, so rank by exploit probability instead.
• Outside KEV, the highest EPSS scores are CVE-2026-42492 (0.5%), CVE-2026-62434 (0.4%), CVE-2026-62431 (0.4%).
• 0 CVEs score Critical and 4 High on CVSS v3 (maximum 7.8, average 6.9); sequence these after KEV and high-EPSS items.

About this data

Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-20 and refresh daily.