New maintenance update candidates for XCP-ng 8.3 LTS This update is focused on security fixes. What changed edk2: Sync with XenServer edk2-20220801-1.7.13. The update fixes vulnerabilities allowing an unauthenticated attacker on the local network to compromise a VM during PXE boot, or enable a guest VM administrator to bypass Secure Boot. See below the list of the corresponding CVEs: CVE-2026-97631 CVE-2024-38796 CVE-2024-38797 CVE-2019-14560 CVE-2022-36763 CVE-2022-36764 CVE-2026-45447 CVE-2026-111497 Versions edk2: 20220801-1.7.11.2.xcpng8.3 -> 20220801-1.7.13.1.xcpng8.3 Test on XCP-ng 8.3 yum clean metadata --enablerepo=xcp-ng-testing,xcp-ng-candidates yum update --enablerepo=xcp-ng-testing,xcp-ng-candidates reboot # not mandatory but recommended for testing The usual update rules apply: pool coordinator first, etc. What to test As usual, normal use and anything else you want to test. Additionally, a cold boot (shutdown and start) of the UEFI VMs would also help testing the edk2 fix. Test window before official release of the updates About 4 days We would like to thank users who shared feedback since our last call for testing: @acebmxer, @jr-m4, @bufanda, @flakpyro, @Andrew, @MajorP93, @JeffBerntsen, @manilx, @XCP-ng-JustGreat, @john205, @Greg_E. We are aware of the frequency of these updates and strive to batch packages as much as possible. However, recent unplanned security updates require immediate attention. While drafting this message, we received another security update that we will release shortly.