Vulnerability intelligence
CVE-2026-23556 and is rated Critical severity with a CVSS score of 9.4. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.
We have pushed updates to both the Early Access and Normal update channels of XenServer 8.4. We recommend that customers update to the latest version from their chosen channel following the instructions at https://docs.xenserver.com/en-us/xenserver/8/update
When oxenstored is tearing a domain down, the node data is cleaned up but the usage counts are leaked.
When the domain ID is eventually reused, the new domain can create fewer nodes before beeing deemed to be over quota.
Source: NVD