How to fix or mitigate EUVD-2026-42604?

24 hours: Inventory all Xen deployments and determine affected versions from XSA-489 advisory; restrict new guest VM provisioning from untrusted sources. 7 days: Deploy enhanced hypervisor monitoring for suspicious guest behavior; review guest VM isolation profiles and apply strict least-privilege access controls. 30 days: Monitor Xen security advisories for patch release; maintain staged deployment plan for immediate patching when available.

EUVD-2026-42604

Q: What is the CVSS score of EUVD-2026-42604?

EUVD-2026-42604 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-23561 CRITICAL

Execution with Unnecessary Privileges (CWE-250)

2026-05-08

GHSA-35jv-46p3-x4g4

Privilege Escalation

9.4

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (CNA) · only source for this CVE.

CVSS VectorVendor

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 16:57 vuln.today

CVSS changed

Jul 09, 2026 - 16:22 NVD

9.4 (CRITICAL)

CVE Published

May 08, 2026 - 06:45 nvd

UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Local privilege escalation in the Xen hypervisor, disclosed as one of five issues under Xen Security Advisory XSA-489 (alongside CVE-2026-23559/23560/23562/42486), lets a malicious or compromised guest run code with more privilege than intended and cross the guest/host trust boundary. The CVSS 4.0 vector (AV:L, scope-changed with high confidentiality, integrity and availability impact to subsequent systems) indicates a guest can affect the underlying host and other guests, consistent with the CWE-250 'execution with unnecessary privileges' root cause. No public exploit identified at time of analysis, and it is not listed in CISA KEV.