CVE-2025-27462

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. Several of these have no security descriptor, and are therefore fully accessible to unprivileged users. These are: 1. XenCons, CVE-2025-27462 2. XenIface, CVE-2025-27463 3. XenBus, CVE-2025-27464

• CWE-276

• https://xenbits.xen.org/xsa/advisory-468.html

Published

Jul 9, 2026

Last Modified

Jul 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-27457All communication between the VNC server and client(s) is un…7.5
• CVE-2025-27458The VNC authentication mechanism bases on a challenge-respon…7.5
• CVE-2025-27459The VNC application stores its passwords encrypted within th…7.5
• CVE-2025-2746An authentication bypass vulnerability in Kentico Xperience …9.8
• CVE-2025-27460The hard drives of the device are not encrypted using a full…6.8
• CVE-2025-27461During startup, the device automatically logs in the EPC2 Wi…6.8
• CVE-2025-27463[This CNA information record relates to multiple CVEs; the t…9.4
• CVE-2025-27464[This CNA information record relates to multiple CVEs; the t…9.4
• CVE-2025-27465Certain instructions need intercepting and emulating by Xen.…4.3
• CVE-2025-27466[This CNA information record relates to multiple CVEs; the t…9.8
• CVE-2025-27467Use after free in Windows Digital Media allows an authorized…7.8
• CVE-2025-27468Improper privilege management in Windows Secure Kernel Mode …7