# Xen vulnerabilities Source: https://junglewise.ai/threats/vendors/xen Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/xen.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 9 vulnerabilities in Xen: 0 in the last 7 days and 6 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-79610, was published on 13 October 2026. 3 vulnerabilities in the last four weeks, up from none in the four before. 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 6 - All time: 9 (0 critical, 0 exploited in the wild) ## About Xen Xen is a hypervisor that provides virtualization for x86, ARM, and other processor architectures. ## Latest Xen vulnerabilities - [CVE-2026-79610: Xen grant-table double version change race condition](https://junglewise.ai/threats/cve-2026-79610-xsa-501-was-about-issues-with-v1-v2-and-v2-v1-changes-racing) (info, published 13 Oct 2026) - [CVE-2026-79607: Xen Xenstore crash during live update with watch depth](https://junglewise.ai/threats/cve-2026-79607-during-xenstore-live-update-the-state-record-for-a-xenstore-watch) (info, published 13 Oct 2026) - [CVE-2026-102699: Xen hypervisor calculation underflow in GNTTABOP_cache_flush on Arm](https://junglewise.ai/threats/cve-2026-102699-this-cna-information-record-relates-to-multiple-cves-the-text) (info, published 13 Oct 2026) - [CVE-2026-79603: Xen TLB flush race condition allowing stale page modification](https://junglewise.ai/threats/cve-2026-79603-xen-tlb-flush-race-condition-allowing-stale-page-modification) (medium, CVSS 4.3, published 8 Sep 2026) - [CVE-2026-79602: Xen improper HVM emulation return code handling](https://junglewise.ai/threats/cve-2026-79602-xen-improper-hvm-emulation-return-code-handling) (high, CVSS 8.8, published 8 Sep 2026) - [CVE-2026-62437: Xen hypervisor memory leak in IRQ tracking during guest cleanup](https://junglewise.ai/threats/cve-2026-62437-xen-hypervisor-memory-leak-in-irq-tracking-during-guest-cleanup) (medium, CVSS 6.5, published 8 Sep 2026) - [CVE-2025-58149: When passing through PCI devices, the detach logic in libxl won't remove access permissions to any 64bit memory BARs the…](https://junglewise.ai/threats/cve-2025-58149-when-passing-through-pci-devices-the-detach-logic-in-libxl-won-t) (high, CVSS 7.5, published 31 Oct 2025) - [CVE-2025-58148: This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to…](https://junglewise.ai/threats/cve-2025-58148-this-cna-information-record-relates-to-multiple-cves-the-text) (high, CVSS 7.5, published 31 Oct 2025) - [CVE-2025-58147: This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to…](https://junglewise.ai/threats/cve-2025-58147-this-cna-information-record-relates-to-multiple-cves-the-text) (high, CVSS 7.5, published 31 Oct 2025) ## Most severe Xen vulnerabilities - [CVE-2026-79602: Xen improper HVM emulation return code handling](https://junglewise.ai/threats/cve-2026-79602-xen-improper-hvm-emulation-return-code-handling) (high, CVSS 8.8, published 8 Sep 2026) - [CVE-2025-58149: When passing through PCI devices, the detach logic in libxl won't remove access permissions to any 64bit memory BARs the…](https://junglewise.ai/threats/cve-2025-58149-when-passing-through-pci-devices-the-detach-logic-in-libxl-won-t) (high, CVSS 7.5, published 31 Oct 2025) - [CVE-2025-58148: This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to…](https://junglewise.ai/threats/cve-2025-58148-this-cna-information-record-relates-to-multiple-cves-the-text) (high, CVSS 7.5, published 31 Oct 2025) - [CVE-2025-58147: This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to…](https://junglewise.ai/threats/cve-2025-58147-this-cna-information-record-relates-to-multiple-cves-the-text) (high, CVSS 7.5, published 31 Oct 2025) - [CVE-2026-62437: Xen hypervisor memory leak in IRQ tracking during guest cleanup](https://junglewise.ai/threats/cve-2026-62437-xen-hypervisor-memory-leak-in-irq-tracking-during-guest-cleanup) (medium, CVSS 6.5, published 8 Sep 2026) - [CVE-2026-79603: Xen TLB flush race condition allowing stale page modification](https://junglewise.ai/threats/cve-2026-79603-xen-tlb-flush-race-condition-allowing-stale-page-modification) (medium, CVSS 4.3, published 8 Sep 2026) - [CVE-2026-79610: Xen grant-table double version change race condition](https://junglewise.ai/threats/cve-2026-79610-xsa-501-was-about-issues-with-v1-v2-and-v2-v1-changes-racing) (info, published 13 Oct 2026) - [CVE-2026-79607: Xen Xenstore crash during live update with watch depth](https://junglewise.ai/threats/cve-2026-79607-during-xenstore-live-update-the-state-record-for-a-xenstore-watch) (info, published 13 Oct 2026) - [CVE-2026-102699: Xen hypervisor calculation underflow in GNTTABOP_cache_flush on Arm](https://junglewise.ai/threats/cve-2026-102699-this-cna-information-record-relates-to-multiple-cves-the-text) (info, published 13 Oct 2026) ## Vulnerabilities per week 3 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 3 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 3 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Xen technologies - [Xen](https://junglewise.ai/threats/technologies/xen-xen): 5 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Xen vulnerabilities", https://junglewise.ai/threats/vendors/xen, 13 November 2026.