ZeroDay Findings
Sign inSign up

Findings

CVE-2026-79610

XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations.

Published Oct 13, 2026 · updated Oct 14, 2026

XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations. Sadly a v2 -> v1 -> v2 change has yet another effect which wasn't accounted for: During the first change, status pages would be freed. During the second change they would be

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 13, 2026 · NIST NVD

    Detected

    XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations. Sadly a v2 -> v1 -> v2 change has yet another effect which wasn't accounted for: During the first change, status pages would be freed. During the second change they would be allocated again. Hence across the full pair of change the addresses of the status pages may change, rendering stale previ

  2. Oct 14, 2026 · NIST NVD

    Updated

    XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations. Sadly a v2 -> v1 -> v2 change has yet another effect which wasn't accounted for: During the first change, status pages would be freed. During the second change they would be allocated again. Hence across the full pair of change the addresses of the status pages may change, rendering stale previ

Sources

  • Canadian Centre for Cyber SecurityGovernment advisoryCVE-2026-79610

    Serial number: AV26-1034 Date: October 13, 2026 As of October 13, 2026, Citrix is affected by vulnerabilities in the following products: UniconOS Prior to 2603 LTSR CU2 Prior to 2607.2 CR XenServer Version 8.4 XenServer Version 9 The Cyber Centre encourages users and administrato

    cyber.gc.ca
  • CVE.orgVulnerability recordCVE-2026-79610

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-79610

    30-day exploitation probability 0.2%

    first.org
  • NIST NVDVulnerability recordCVE-2026-79610

    XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations. Sadly a v2 -> v1 -> v2 change has yet another effect which wasn't accounted for: During the first change, status pages would be freed. During the second change they would be

    nvd.nist.gov

References