CVE-2026-23554Disclosure(xen / xen)

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch xen xen systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The Intel EPT paging code uses an optimization to defer flushing of any cached EPT state until the p2m lock is dropped, so that multiple modifications done under the same locked region only issue a single flush. Freeing of paging structures however is not deferred until the flushing is done, and can result in freed pages transiently being present in cached state. Such stale entries can point to memory ranges not owned by the guest, thus allowing access to unintended memory regions.

xen CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

Weakness type (CWE)

CWE-367

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

Threat summary

Patch or workaround signal is available
9 mentions across 6 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 5 signals
Disclosure: 5 classified signals
General: 2 classified signals
Peaked 5d ago at 2 mentions (2026-03-17); latest day: 1
9 total mentions across 6 days

Affected systems

Vendors

xen

Products

xen

Deep dive

Activity timeline9 mentions / 6d

Signal classification3 categories

Disclosure

555.6%

Patch

222.2%

General

222.2%

Referenced assets10 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-17	2	Disclosure2
2026-03-18	2	Disclosure1Patch1
2026-03-19	1	General1
2026-03-21	1	Patch1
2026-03-23	2	Disclosure2
2026-03-27	1	General1

Full discourse9 posts

Open Source Security mailing list@oss_security204d
Disclosure
Xen Security Advisory 480 v3 (CVE-2026-23554) - Use after free of paging structures in EPT https://www.openwall.com/lists/oss-security/2026/03/17/6 Xen Security Advisory 481 v2 (CVE-2026-23555) - Xenstored DoS by unprivileged domain https://www.openwall.com/lists/oss-security/2026/03/17/7
Post summary
Two Xen security advisories (CVE‑2026‑23554 and CVE‑2026‑23555) announce the vulnerabilities, providing technical descriptions but no proof‑of‑concept or exploit details.
01062938
4.4K followersView on X
Autumn Good@autumn_good_35204d
Disclosure
Xenで2件の脆弱性。ただ、それよりも気になるのは事前リリース済みで3/24まで公開禁止となっているXSA-482ですね🤔 CVE-2026-23555 Xenstored DoS by unprivileged domain CVE-2026-23554 Use after free of paging structures in EPT Xen Security Advisories https://xenbits.xen.org/xsa/
Post summary
The post announces two Xen CVEs with short technical descriptions and links to the advisory page, but does not mention PoC, exploit code, active exploitation, or patches.
120401.7K
6.7K followersView on X
Autumn Good@autumn_good_35200d
Patch
『An issue has been identified in XenServer 8.4 that may allow privileged code in a guest VM to compromise the host』 CITRIX | Support XenServer Security Update for CVE-2026-23554 https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696350&articleURL=XenServer_Security_Update_for_CVE_2026_23554
Post summary
A security update is available for XenServer 8.4 CVE-2026-23554, addressing a privilege escalation that could allow a guest VM to compromise the host; no proof of concept, exploit code, or active exploitation activity is disclosed.
00010432
6.7K followersView on X
CERT-PY@CERTpy202d
General
⚠️ Vulnerabilidad en productos Citrix ❗ CVE-2026-23554 ➡️ Más info: https://www.cert.gov.py/vulnerabilidad-en-productos-citrix-3/ https://t.co/ch9RbmDR8Z
Post summary
The message announces a Citrix vulnerability (CVE-2026-23554) and directs readers to a government CERT page for further details, without providing specifics on the exploit, mitigation, or technical characteristics.
0100097
6.6K followersView on X
Deniz@denizpekdas195d
General
XenServer 8.4 Güvenlik Açığı: CVE-2026-23554 https://www.denizpekdas.com/xenserver-8-4-guvenlik-acigi-cve-2026-23554/
Post summary
The post announces a CVE‑2026‑23554 vulnerability affecting XenServer 8.4, offering only the CVE reference and a link to an external article, with no further technical or exploit information.
0000052
1.2K followersView on X
CVEarity@CVEarity198d
Disclosure
⚡ New CVE Alert: CVE-2026-23554 🚨 Risk Level: Unknown 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-23554 #CVE-2026-23554 #CVE #CyberSecurity #InfoSec https://t.co/E4UXHJzf71
Post summary
A new CVE-2026-23554 has been announced with an unknown risk level affecting multiple unspecified products, but no detailed vulnerability or exploitation information is provided.
0000023
111 followersView on X
CVE@CVEnew199d
Disclosure
CVE-2026-23554 The Intel EPT paging code uses an optimization to defer flushing of any cached EPT state until the p2m lock is dropped, so that multiple modifications done under the … https://www.cve.org/CVERecord?id=CVE-2026-23554
Post summary
The text announces CVE‑2026‑23554, noting a flaw in Intel EPT paging code with deferred flushing of cached state, but it provides no proof‑of‑concept, exploit, patch, or evidence of active exploitation.
0000057
56.8K followersView on X
IntraSystems, LLC@Intra_Access203d
Patch
SEVERITY ALERT! Citrix XenServer 8.4 CVE-2026-23554 allows a guest VM to compromise the host system. Update to latest firmware/software now and verify all XenServer 8.4 hosts are patched. https://hubs.la/Q047n-9w0 For help contact servicedesk@intrasystems.com #Citrix #XenServer
Post summary
The message announces that CVE-2026-23554 enables a guest VM to escape and compromise the host on Citrix XenServer 8.4, and urges users to apply the latest firmware/software update immediately.
0000050
304 followersView on X
VulDB 🛡@vuldb204d
Disclosure
A new vulnerability with increased severity was disclosed for Xen (CVE-2026-23554) https://vuldb.com/?id.351512
Post summary
The tweet announces that a new vulnerability, CVE‑2026‑23554 in Xen, has been disclosed with increased severity.
0000058
2.1K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	xen	xen	-	-	x86

Explore more

Back to dashboard xen CVEs xen vulnerabilities

What researchers are saying

CVE-2026-23554

Deniz[verified]@denizpekdasGeneral

The post announces a CVE‑2026‑23554 vulnerability affecting XenServer 8.4, offering only the CVE reference and a link to an external article, with no further technical or exploit information.

Open Source Security mailing list@oss_securityDisclosure

Two Xen security advisories (CVE‑2026‑23554 and CVE‑2026‑23555) announce the vulnerabilities, providing technical descriptions but no proof‑of‑concept or exploit details.

Autumn Good@autumn_good_35Disclosure

The post announces two Xen CVEs with short technical descriptions and links to the advisory page, but does not mention PoC, exploit code, active exploitation, or patches.

Autumn Good@autumn_good_35Patch

A security update is available for XenServer 8.4 CVE-2026-23554, addressing a privilege escalation that could allow a guest VM to compromise the host; no proof of concept, exploit code, or active exploitation activity is disclosed.

CERT-PY@CERTpyGeneral

The message announces a Citrix vulnerability (CVE-2026-23554) and directs readers to a government CERT page for further details, without providing specifics on the exploit, mitigation, or technical characteristics.

CVEarity@CVEarityDisclosure

A new CVE-2026-23554 has been announced with an unknown risk level affecting multiple unspecified products, but no detailed vulnerability or exploitation information is provided.

CVE@CVEnewDisclosure

The text announces CVE‑2026‑23554, noting a flaw in Intel EPT paging code with deferred flushing of cached state, but it provides no proof‑of‑concept, exploit, patch, or evidence of active exploitation.

IntraSystems, LLC@Intra_AccessPatch

The message announces that CVE-2026-23554 enables a guest VM to escape and compromise the host on Citrix XenServer 8.4, and urges users to apply the latest firmware/software update immediately.