PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-56535 OpenNebula CVE debrief

A cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the zone attribute parameter. The CVE record was published on 2026-04-29T16:16:21.610Z and has not been modified since then. This vulnerability affects OpenNebula deployments, and defenders responsible for these deployments should assess the potential impact on their systems and prioritize verification and remediation efforts. The vulnerability allows attackers to execute arbitrary web scripts or HTML, potentially leading to unauthorized actions or data breaches. Defenders need to verify the presence of this vulnerability,

Vendor
OpenNebula
Product
OpenNebula
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-29
Original CVE updated
2026-10-23
Advisory published
2026-04-29
Advisory updated
2026-10-23

Who should care

Defenders responsible for OpenNebula deployments should assess the potential impact of this vulnerability on their systems and prioritize verification and remediation efforts.

Why it matters

CVE-2025-56535 is a cross-site scripting (XSS) vulnerability in OpenNebula that allows attackers to execute arbitrary web scripts or HTML. Defenders responsible for OpenNebula deployments should assess the potential impact on their systems and prioritize verification and remediation efforts.

  • Defenders need to verify the presence of this vulnerability in their OpenNebula deployments.
  • The vulnerability could allow attackers to execute arbitrary web scripts or HTML.
  • Remediation efforts should be prioritized to prevent potential attacks.

Technical summary

The CVE record describes a cross-site scripting (XSS) vulnerability in OpenNebula v6.10.0.1. The vulnerability allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the zone attribute parameter. This vulnerability affects OpenNebula deployments, and defenders should prioritize verifying the presence of this vulnerability in their systems and assess the potential impact. The vulnerability could allow attackers to execute arbitrary web scripts or HTML, potentially leading to unauthorized actions or data breaches. Defenders

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their OpenNebula deployments and assess the potential impact on their systems.

Recommended defensive actions

  • Verify the presence of this vulnerability in OpenNebula deployments
  • Assess the potential impact on systems
  • Consider upgrading to a version that is not vulnerable

Evidence notes

The CVE record and NVD vulnerability detail page provide information about the XSS vulnerability in OpenNebula. However, the exact versions affected and the remediation steps are not clearly stated.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-56535 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-56535

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-56535 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-56535

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.