Xen Hypervisor EUVD-2026-42602

Exploitation requires the attacker to be running code inside a Xen guest domain on an affected host - i.e., control of at least one virtual machine - which is the concrete prerequisite implied by AV:L (Local) for a hypervisor. No user interaction is required (UI:N) and no additional in-guest authentication step is indicated (AT:N). What limits exploitation: the attacker cannot reach this remotely over the network without first landing code in a guest, so hosts that run only trusted, first-party guests face substantially lower realistic risk than multi-tenant or hostile-guest environments; the exact vulnerable subsystem, affected Xen versions, and any non-default configuration triggers are specified in XSA-489 and are not fully recoverable from the mailing-list description supplied here, so confirm configuration-specific conditions against the vendor advisory.

Signals are moderately consistent and point to a genuine high priority for virtualization operators, though not an emergency at internet scale. The CVSS 4.0 base score is 9.4 (critical) driven by AV:L/AC:L/AT:N/PR:N/UI:N with high vulnerable-system impact (VC:H/VI:H/VA:H) AND high subsequent-system impact (SC:H/SI:H/SA:H) - the subsequent-system metrics are the tell that this is a scope-crossing guest-to-host escalation, which is the worst case for a hypervisor. Countering the raw score: the attack vector is Local (AV:L), meaning the attacker must already be executing code inside a guest domain, so this is an escalation primitive rather than a remote entry point. No EPSS score was provided, there is no POC in the supplied data, and it is not in CISA KEV, so there is no evidence of active or automatable exploitation yet. Note the vector lists PR:N while realistically the attacker needs control of a guest VM - for a hypervisor, 'operating a guest' is the effective prerequisite; treat the PR:N as scoring convention rather than 'no access needed.' Bottom line: high priority to patch on multi-tenant or untrusted-guest Xen hosts; lower urgency where all guests are already trusted.

An attacker who has already obtained code execution inside a Xen guest domain (for example a paying tenant on a multi-tenant cloud host, or an intruder who compromised a single VM) triggers the flawed guest-reachable code path in the hypervisor to escape guest confinement. Because the CVSS scope changes with high subsequent-system impact, successful exploitation yields control over the host and potentially other co-located guests. No public exploit is identified at time of analysis, so exploitation would currently require independent development against the XSA-489 details.