# ANSSI flags multiple Xen hypervisor flaws

Published: 2026-09-09 · Severity: routine · Sectors: technology, infrastructure
Canonical: https://vorant.io/reports/dd4509bb-00f8-59e0-b386-6238cf24d607/anssi-flags-multiple-xen-hypervisor-flaws

> ANSSI advisory details six CVEs in Xen enabling arbitrary code execution, remote denial of service, and security bypass; patches available.

The French national cybersecurity agency ANSSI (CERT-FR) issued an advisory covering multiple vulnerabilities in the Xen hypervisor, affecting all versions lacking the latest security patches. The flaws, tracked as XSA-509 through XSA-513 and assigned six CVE identifiers, allow attackers to bypass security policies, cause remote denial of service, and in some cases execute arbitrary code.

No exploitation in the wild is mentioned in the advisory. ANSSI recommends organizations refer to the official Xen Project security bulletins for patches and apply them promptly. Given Xen's widespread use as a virtualization platform underpinning cloud and enterprise infrastructure, unpatched systems could expose hosted workloads to compromise or service disruption, particularly in multi-tenant environments where hypervisor security bypasses have outsized impact.

## Mentioned in this report

- Vulnerabilities: CVE-2026-62437, CVE-2026-79602, CVE-2026-79603, CVE-2026-79604, CVE-2026-79605, CVE-2026-79606

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1136

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/dd4509bb-00f8-59e0-b386-6238cf24d607/anssi-flags-multiple-xen-hypervisor-flaws.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup