The version of libvirt installed on the remote host is prior to 4.5.0-36. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3873 advisory.

    libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection     (CVE-2026-61477)

    libvirt: Check for empty string condition and skip inclusion of the XML document context in the error     message. (CVE-2026-61478)

    A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm`     user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a     symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon     into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation     from the `swtpm` sandbox to root-level file ownership control. (CVE-2026-63622)

    A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume     images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly     permissive file creation settings, allowing any local user to read the full guest disk contents. This     vulnerability could lead to sensitive information disclosure from guest virtual machines. (CVE-2026-63623)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8652-1 advisory.

    It was discovered that libvirt incorrectly handled guest reboots in the libxl driver. An attacker in a     guest could possibly use this issue to cause the libvirt daemon to crash, resulting in a denial of     service. This issue only affected Ubuntu 16.04 LTS. (CVE-2021-4147)

    Alexander Kuznetsov discovered that libvirt incorrectly handled listing network interfaces. An attacker     could possibly use this issue to cause the libvirt daemon to crash, resulting in a denial of service. This     issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2024-1441)

    It was discovered that libvirt incorrectly handled certain values in its RPC library. An attacker could     possibly use this issue to cause the libvirt daemon to crash, resulting in a denial of service. This issue     only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2024-2494)

    It was discovered that libvirt incorrectly handled listing network interfaces under certain circumstances.
    An attacker could possibly use this issue to cause the libvirt daemon to crash, resulting in a denial of     service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.
    (CVE-2024-2496)

    It was discovered that libvirt incorrectly set permissions on external inactive snapshots, making them     world-readable. A local attacker could possibly use this issue to obtain sensitive information. This issue     only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2025-13193)

    It was discovered that libvirt incorrectly handled certain characters in virtual network definitions. An     authenticated user could possibly use this issue to inject arbitrary configuration directives and execute     arbitrary code as root. This issue did not affect Ubuntu 14.04 LTS. (CVE-2026-61477)

    It was discovered that libvirt incorrectly handled certain XML input. An attacker could possibly use this     issue to cause the libvirt daemon to crash, resulting in a denial of service. (CVE-2026-61478)

    He Wei discovered that libvirt incorrectly followed symbolic links when changing file ownership. A local     attacker could possibly use this issue to escalate privileges. This issue only affected Ubuntu 20.04 LTS,     Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-63622)

    It was discovered that libvirt incorrectly set permissions on images during storage volume clone and     convert operations, making them temporarily world-readable. A local attacker could possibly use this issue     to obtain sensitive information. (CVE-2026-63623)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:65516 advisory.

    The libvirt library contains a C API for managing and interacting with the virtualization capabilities of     Linux and other operating systems. In addition, libvirt provides tools for remote management of     virtualized systems.

    Security Fix(es):

    * libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1982:08 advisory.

    * libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622)
      * libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (CVE-2026-18917)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69131 advisory.

    Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware     platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual     machines using KVM.The packages also provide APIs for managing and interacting with the virtualized     systems.

    Security Fix(es):

    * qemu-kvm: VNC WebSocket handshake use-after-free (CVE-2025-11234)

    * virt:rhel/libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622)

    * virt:rhel/libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (CVE-2026-18917)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:74424 advisory.

    * libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622)
      * libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (CVE-2026-18917)


    Bug Fix(es) and Enhancement(s):

      * Live migration fails when virtio-vga becomes available, video device switches from virtio-gpu-pci to     virtio-vga on target [almalinux-9.8.z] (JIRA:AlmaLinux-186018)
      * libvirt-guests does not work together with virtlockd on shutdown [almalinux-9.8.z]     (JIRA:AlmaLinux-224986)
      * Expose guest-get-devices in libvirt-api [almalinux-9.8.z] (JIRA:AlmaLinux-243306)
      * allow hyperv pvpanic device to process Windows crash dump [almalinux-9.8.z] (JIRA:AlmaLinux-242549)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69114 advisory.

    The libvirt library contains a C API for managing and interacting with the virtualization capabilities of     Linux and other operating systems. In addition, libvirt provides tools for remote management of     virtualized systems.

    Security Fix(es):

    * libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622)

    * libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (CVE-2026-18917)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0978 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-63623:
    A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume     images were temporarily world-readable. This was caused by the qemu-img utility running with overly     permissive file creation settings, allowing any local user to read the full guest disk contents. This     vulnerability could lead to sensitive information disclosure from guest virtual machines.

    CVE-2026-63622:
    A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user,     could exploit a symlink-following vulnerability in the virFileChownFiles() function. By planting a     symbolic link within the swtpm state directory, the attacker could trick the root-level libvirt daemon     into changing the ownership of an arbitrary file to the swtpm user. This allows for privilege escalation     from the swtpm sandbox to root-level file ownership control.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
341892	Amazon Linux 2 : libvirt, --advisory ALAS2-2026-3873 (ALAS-2026-3873)	Nessus	Amazon Linux Local Security Checks	2026/8/31	2026/9/18	high
365450	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : libvirt vulnerabilities (USN-8652-1)	Nessus	Ubuntu Local Security Checks	2026/10/13	2026/10/13	medium
343894	RHEL 9 : libvirt (RHSA-2026:65516)	Nessus	Red Hat Local Security Checks	2026/9/8	2026/9/18	high
363867	MiracleLinux 9 : libvirt-11.10.0-12.7.el9_8.ML.1 (AXSA:2026-1982:08)	Nessus	Miracle Linux Local Security Checks	2026/10/7	2026/10/8	high
348376	RHEL 8 : virt:rhel (RHSA-2026:69131)	Nessus	Red Hat Local Security Checks	2026/9/21	2026/9/25	high
362946	AlmaLinux 9 : libvirt (ALSA-2026:74424)	Nessus	Alma Linux Local Security Checks	2026/10/5	2026/10/5	high
348381	RHEL 7 : libvirt (RHSA-2026:69114)	Nessus	Red Hat Local Security Checks	2026/9/21	2026/9/25	high
344405	TencentOS Server 4: libvirt (TSSA-2026:0978)	Nessus	Tencent Local Security Checks	2026/9/9	2026/9/18	high

检测

插件搜索

high

medium

high

high

high

high

high

high