Xen says XSA-523 lets a guest read and write Dom0 memory; CISA-ADP scores it 4.4, CodeAnt publishes 9.3

Five days in: no score from Xen, 4.4 from CISA-ADP, 9.3 from a finder

Five calendar days after Xen published XSA-523 (derived: 3 November to 8 November 2026), the two flaws it covers carry three different severity positions. Xen's advisory prints no score. The CISA ADP container on each CVE record gives 4.4 Medium. CodeAnt AI, one of the credited finders, publishes 9.3 under CVSS 3.1 and 9.4 under CVSS 4.0 for both.

Xen's statement of impact is one sentence: "A malicious guest can read and write arbitrary memory, belonging to other domains, including Dom0." Its statement of mitigation is shorter: "There is no known mitigation."

None of those numbers shows that anyone has used the flaws. Xen's advisory does not mention exploitation. The SSVC entry CISA added on 4 November reads Exploitation none, and neither CVE appears in version 2026.11.06 of the CISA Catalog of Known Exploited Vulnerabilities, as read at about 09:35 UTC on Sunday 8 November 2026. Those are statements about what had been reported by those dates, not proof that nothing has happened.

What Xen says went wrong

Xen says a common access pattern is "a batch of Grant Copy operations acting on adjacent address ranges in the same source or destination page", and that for performance it caches details to reuse data it has already validated. "The conditions on when to re-validate the internal data were not correct in some cases". Xen gives two cases, one CVE each:

• CVE-2026-102703: "Frame numbers and grant references could wrongly be mixed up."
• CVE-2026-102704: copying by frame number, rather than by grant reference, is permitted only on the caller's own memory. "The check to enforce this restriction was misplaced."

Zoom

Version 2 of the advisory, marked as the public release, went out at 12:00 UTC on 3 November. The CVE records followed at 10:30 UTC on 4 November, 22.5 hours later (derived). The advisory stops at this level of detail. It does not say how a guest reaches either condition.

Two ratings that do not describe the same event

CISA's container on each record, titled Vulnrichment, gives both CVEs the identical vector and 4.4 Medium. Xen's own container on each record has no metrics block and its advisory prints no score, so the only CVSS figure on the CVE records is a third party's enrichment, added about eight hours after Xen's record (derived: 10:30 UTC to 18:24 and 18:26 UTC on 4 November).

Zoom

The firmest mismatch is in the two Low values. CVSS 3.1 keeps Low for an attacker without control over what is obtained or changed, or where the amount is limited. Xen's word is "arbitrary". As written, the advisory does not describe the Low case.

Scope is the harder field, and what follows is this site's inference. CVSS 3.1 calls a flaw Unchanged when only resources under the same security authority are affected, and lists "a sandbox environment" among its examples of an authority. Xen's text has a guest reaching other domains and Dom0, which on that reading is a crossing. An analyst might instead treat Xen as the single authority over all domain memory and keep Unchanged. The record does not say which. Even on that second reading, Scope would not explain the two Low values.

Attack vector Local and Privileges Low do not pull against the advisory. Attack complexity Low and user interaction None are CISA's encoding of points the advisory does not address. Availability None is neither supported nor contradicted, since Xen's impact sentence mentions only reading and writing.

The records hold two more signals. The SSVC entry gives Technical Impact partial and Automatable no. CISA assigns the two faults different weakness classes, CWE-704 for CVE-2026-102703 and CWE-693 for CVE-2026-102704, and then scores them identically. No rationale for any of these values is printed. NVD, read at the same time, lists the same vector with CISA as its source, labels it Secondary, shows the record as Undergoing Analysis and carries no NVD score of its own. This site does not offer a replacement score: the point is that the published positions cannot all describe one event.

Medium is a label, not a control

An organisation that patches by CVSS band would, on the only score in the CVE and NVD records as read, queue XSA-523 as a Medium. That is this site's inference about triage practice, not a report about any organisation. Because Xen lists no mitigation, there is nothing to apply in the meantime, so the queue position is the whole decision.

The caution runs the other way as well. CodeAnt calls the flaw Xenbleed, a name that does not appear in Xen's advisory. A name and a Critical badge do not show that any given host can be reached.

What the credit says, and what it does not

The advisory's credit reads: "This issue was discovered by Anthropic using Claude", then validated by a researcher at Ada Logics. "It was then independently reported by the CodeAnt AI Security Research Team." Two independent finders is what Xen records. Anthropic sells the Claude model named in that credit. CodeAnt AI sells AI penetration testing and code security products, and its write up also promotes them.

The credit does not say how Claude was used, how much a person directed it, or how long either party took, and this briefing infers none of that. CodeAnt gives dates for its own part: it says it reported to the Xen Project security team and Cloud Software Group on 13 October, and that Xen replied on 14 October that the issue was already known. Neither the advisory nor CodeAnt's page gives a date for the other report. The two patches for xen-unstable to 4.19.x each carry a Reported-by line for CodeAnt, which this site read in the files as served.

What CodeAnt adds, and the limits it states

CodeAnt's page, dated 4 November, goes well beyond the advisory. It says "We built a working guest-to-dom0 escape on XenServer 9" and names its test system as XenServer 9.0.0 running Xen 4.21.2-3. It says it used that access to run "a short, reversible instruction sequence in the dom0 Linux kernel". Xen's advisory says nothing about code execution in Dom0. That is CodeAnt's claim, and this site has not reproduced it.

CodeAnt also states limits. Its chain exercised CVE-2026-102704 and "we did not independently exercise CVE-2026-102703". Its proof "ran Xen with one pCPU" and "SMP reliability was not measured." And: "We did not build a general-purpose dom0 shell."

It dates the flaw to a commit of 29 January 2015 and counts 4,296 days. This site recomputed that interval from 29 January 2015 to 3 November 2026 and it matches (derived). The advisory gives no commit date and says only that versions from 4.6 onwards are vulnerable.

On who can attack, Xen says only "A malicious guest". CodeAnt says: "The attacker must already control a guest kernel, which includes a tenant who can supply a custom kernel." That is CodeAnt's statement, not Xen's. CodeAnt also says proof of concept source went privately to Xen and Cloud Software Group; the page as read prints excerpts of Xen source and no proof of concept source, and describes the chain in prose. This briefing repeats none of those steps.

CodeAnt's page attributes its scores two ways. Its timeline says "our CVSS assessment for both CVEs: 9.3 Critical (v3.1) and 9.4 Critical (v4.0)". Its structured FAQ data says "Scores are 9.3 under CVSS 3.1 and 9.4 under CVSS 4.0, per SUSE." No SUSE notice was read for this briefing, so the difference stays unresolved here.

Which versions, and which patches

The advisory's patch list names three stable branches, 4.17.x, 4.18.x and 4.19.x (derived count), plus xen-unstable. Any branch between 4.19.x and xen-unstable falls inside the first row but is not printed; CodeAnt's test system, Xen 4.21.2-3, is one such version on CodeAnt's word.

The 11 minor version lines from 4.6 to 4.16 (derived: 16 minus 6 plus 1) are in scope by the advisory's own words and have no patch listed. The advisory does not say whether a fix exists for them or whether they are still supported.

Xen cautions that patches for released versions "may not apply cleanly to the most recent release tarball", and adds: "Downstreams are encouraged to update to the tip of the stable branch before applying these patches." This site recomputed the SHA-256 of all four patch files as served, and each matches the value printed in the advisory.

The structured affected field on both CVE records says only "consult Xen advisory XSA-523", with a default status of unknown. A tool that reads that field alone receives no version range. The range is in the free text.

What the record states, and what it does not

What to do, in order

Technical details

Each block is copied from the signed advisory or the CVE records as read on 8 November 2026. The advisory prints no exploit, query or indicator, and none is added here.

Xen's statements of impact, affected versions and mitigation. A defender compares the running Xen version against these lines.

IMPACT
A malicious guest can read and write arbitrary memory, belonging to
other domains, including Dom0.

VULNERABLE SYSTEMS
All Xen versions from 4.6 onwards are vulnerable.  Xen versions 4.5 and
earlier are not vulnerable.

MITIGATION
There is no known mitigation.

The patch file list and hashes as printed. A defender verifies downloaded patch files against these hashes before applying them. The first column of the top two lines is a filename pattern.

xsa523-?.patch           xen-unstable - Xen 4.19.x
xsa523-4.18-?.patch      Xen 4.18.x - Xen 4.17.x

$ sha256sum xsa523*
87562e68c584dcc6b568348e7ba6cfde592798cb89f372364792afda65aa6895  xsa523-1.patch
9cd4e76fa3587f491f5bb0f895f375fcf24df8bd9bdf602c343081e7411b92f0  xsa523-2.patch
c1accb1fa55176cb6191e091d93198068630acbc6529966738669a43d5c2e38e  xsa523-4.18-1.patch
efc16fe8830066276fb50f01f24a358194a752507077fdb61a60f891dc1a7019  xsa523-4.18-2.patch
$

The CVE description, identical on the records for CVE-2026-102703 and CVE-2026-102704, from Xen as the CNA.

[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]

A common access pattern is a batch of Grant Copy operations acting on
adjacent address ranges in the same source or destination page.  For
performance reasons, Xen caches details internally to reuse already
validated data.  The conditions on when to re-validate the internal data
were not correct in some cases:

 - Frame numbers and grant references could wrongly be mixed up.  This
   is CVE-2026-102703.

 - Copying by frame number (rather than grant reference) is permitted
   only when operating on the caller's own memory.  The check to enforce
   this restriction was misplaced.  This is CVE-2026-102704.

The CISA enrichment as printed on the records: the CVSS block, the SSVC entry and the weakness classes. A defender uses this to see which number a feed is carrying and who assigned it.

CVE-2026-102703 and CVE-2026-102704, identical on both records:
{
 "cvssV3_1": {
  "scope": "UNCHANGED",
  "version": "3.1",
  "baseScore": 4.4,
  "attackVector": "LOCAL",
  "baseSeverity": "MEDIUM",
  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "integrityImpact": "LOW",
  "userInteraction": "NONE",
  "attackComplexity": "LOW",
  "availabilityImpact": "NONE",
  "privilegesRequired": "LOW",
  "confidentialityImpact": "LOW"
 }
}

CVE-2026-102703 SSVC entry:
{
 "timestamp": "2026-11-04T18:24:51.875183Z",
 "id": "CVE-2026-102703",
 "options": [
  {
   "Exploitation": "none"
  },
  {
   "Automatable": "no"
  },
  {
   "Technical Impact": "partial"
  }
 ],
 "role": "CISA Coordinator",
 "version": "2.0.3"
}

Weakness classes as printed:
CVE-2026-102703: CWE-704 Incorrect Type Conversion or Cast
CVE-2026-102704: CWE-693 Protection Mechanism Failure

The question the three positions leave open

Xen says a guest can read and write the memory of Dom0 and that it knows of no mitigation. The only score on the CVE record says the damage is Low and stays inside one security authority, and a finder says Critical. If your patch queue is ordered by the number your scanner retrieves, which of those three statements is it acting on, and did anyone choose that?

Key facts