Virtualization

Multiple critical vulnerabilities, including CVE-2026-59309 and CVE-2026-59310 with CVSS 9.8, affect VMware vCenter and ESX/ESXi products, enabling unauthorized access without credentials, arbitrary code execution, virtualization escape, information disclosure, and defense evasion, which could lead to full system compromise and data breaches.

Multiple vulnerabilities have been discovered in Xen, allowing an attacker to achieve privilege escalation, remote denial of service, and compromise data confidentiality across all unpatched Xen versions, necessitating immediate patching.

Multiple unspecified vulnerabilities in the Xen hypervisor allow an attacker to escalate privileges, disclose confidential information, or cause a denial-of-service condition affecting virtualized environments.

Multiple vulnerabilities exist in VMware Cloud Foundation, vSphere, Aria Operations, and VMware Tools, allowing an attacker to exploit these weaknesses to gain elevated privileges, including administrative access, and disclose confidential information within affected environments.

A critical vulnerability, CVE-2026-3842, exists in the `hyperv/syndbg` component of Qemu-kvm, allowing an attacker to perform out-of-bounds writes on the host system due to a missing mapped-length guard after a `cpu_physical_memory_map` operation.

A denial-of-service vulnerability (CVE-2026-63806) has been identified in KVM's ioeventfd datamatch handling, allowing a guest virtual machine to trigger a BUG_ON() condition on the host, leading to a system crash.

A local attacker can exploit a vulnerability in QEMU to elevate their privileges and execute arbitrary code on the host system where QEMU is running.

Multiple vulnerabilities exist in QEMU and libvirt, which can be exploited by a local attacker to disclose sensitive information and bypass security mechanisms, potentially leading to privilege escalation.

CVE-2026-53359 is a high-severity use-after-free vulnerability affecting the KVM virtualization component on x86 architectures within the Linux kernel, stemming from an unexpected role in shadow paging, which could lead to host system compromise.

Multiple vulnerabilities, including CVE-2025-10263, CVE-2026-42487, CVE-2026-42488, CVE-2026-42489, and CVE-2026-42490, have been discovered in Xen, allowing an attacker to achieve privilege escalation, trigger a remote denial of service, and compromise data confidentiality on vulnerable hypervisor instances.

Citrix released security advisory AV26-400 on April 28, 2026, addressing vulnerabilities in XenServer versions prior to 8.4, prompting users to apply mitigations.

The BRICKSTORM malware targets VMware vSphere environments, specifically vCenter Server Appliance (VCSA) and ESXi hypervisors, by exploiting weak security configurations to establish persistence at the virtualization layer, leading to administrative control and potential data exfiltration.

An unpatched vulnerability in QEMU's virtio-snd component allows for a hypervisor escape due to an uncontrolled heap overflow.

The Intel EPT paging code vulnerability (CVE-2026-23554) allows access to unintended memory regions due to improper handling of cached EPT state during paging structure freeing.

SUSE Harvester's Rancher integration mechanism is vulnerable to a man-in-the-middle attack due to insecure TLS options, potentially leading to denial of service.

Detects the execution of QEMU with the -nographic flag and an image file on Windows systems, a technique used for persistence and initial access by installing a rogue Linux virtual machine.