Decision RecordActivePublished without chair review
CRT-2026-040219 Oct 2026MORNING EDITIONDaily Roundtable
PwnEscape containment on KVM hosts
Where untrusted guests can reach the relevant guest-controlled KVM path, stop new scheduling, migrate or shut down those guests, dedicate hosts, and block guest access to host or management networks until an authoritative fix is mapped and tested. Use canary patching and monitoring for trusted-only hosts.
Current public guidance · the full record
What to do now
Under reviewAt a glance- UpdatedPatch CVE-2026-99999 on KVM hosts or stop scheduling untrusted guests until fixed builds and the affected-version scope are verified. —
- NewRemediate SiteGuard Server Edition CVE-2026-106931 after preserving forensic evidence; isolate reachable servers when immediate patching is not possible. —
- UpdatedRestrict or patch Nextcloud richdocumentscode through version 26.4.302 and hunt for web shells or command execution associated with CVE-2026-110447. —
- NewUpdate affected Apple platforms for CVE-2024-44308, prioritizing internet-active Intel-based Macs. —
Why now
Under reviewThe source packet dated 2026-10-19 identifies CVE-2026-99999 PwnEscape as a KVM guest-to-host escape, a consequence that can cross a tenant boundary when an untrusted guest can reach the relevant path.
Because neither affected versions nor fixed kernel packages were verified, waiting for a version-specific patch list would leave known exposure conditions unmanaged. The immediate response is therefore based on guest trust and path reachability, not on an unsupported exploitation claim.
The same packet carries separate active-exploitation headlines for CVE-2026-106931 in SiteGuard Server Edition, CVE-2026-110447 in Nextcloud built-in CODE Server, and CVE-2024-44308 on Intel-based Macs, but those headlines do not increase the evidence for CVE-2026-99999.
Who is affected
Under reviewFirst, cloud and hosting operators running KVM hosts with untrusted tenant guests that can reach the relevant guest-controlled path face the stated guest-to-host and potential cross-tenant consequence from CVE-2026-99999.
Second, tenants on those multi-tenant hosts may experience migration, shutdown, or scheduling restrictions while containment is active.
Third, administrators of host and management networks connected to those guests must enforce network separation because the selected controls specifically block guest access to those planes.
Fourth, operators of trusted-only KVM hosts can use canary patching and monitoring rather than immediate guest shutdown. Fifth, KVM hosts verified not to expose the relevant path qualify for reduced priority. No affected kernel or hypervisor versions are established.
Internet-facing SiteGuard Server Edition systems associated with CVE-2026-106931, Nextcloud built-in CODE Server deployments associated with CVE-2026-110447, and Intel-based Macs associated with CVE-2024-44308 are separate populations; this decision does not prescribe their remediation.
What supports this
Under reviewSupport — The CVE-2026-99999 PwnEscape handoff identifies the issue as a KVM guest-to-host escape, supporting treatment as a host and potential cross-tenant containment problem.
Support — The assessed containment analysis specifies the same trust-based sequence adopted here: halt new scheduling, migrate or stop untrusted guests, dedicate hosts, restrict guest access to host and management networks, and retain controls until a tested fix is deployed.
Evidence gap — The affected-version audit found no kernel or hypervisor version range, so it supports precautionary scoping by confirmed path exposure rather than version-based claims.
Evidence gap — The release audit found no vendor release or package evidence for a fixed kernel, so no build can yet be named as remediation.
Context only — Separate headlines describe CVE-2026-106931 in SiteGuard Server Edition, CVE-2026-110447 in Nextcloud built-in CODE Server, and CVE-2024-44308 on Intel-based Macs; they do not support the CVE-2026-99999 KVM containment decision.
How the Roundtable reached this
Under reviewThe decision scout identified CVE-2026-99999 PwnEscape as a potential KVM guest-to-host escape and proposed controls based on whether untrusted guests can reach the relevant guest-controlled path.
The evidence audit supported the containment sequence but found two decisive gaps: no affected kernel or hypervisor version range and no verified fixed kernel package.
The boundary review resolved that tension by limiting the guidance to precautionary, exposure-based controls and avoiding any claim of in-the-wild exploitation or a named fixed build.
The linker found no prior decision to update, and the arbiter selected a new operational decision because the trust-based containment remained justified despite the version and package gaps.
CVE-2026-106931, CVE-2026-110447, and CVE-2024-44308 entered the input as merged, separate signals; their SiteGuard Server Edition, Nextcloud built-in CODE Server, and Intel-based Mac headlines did not establish facts about CVE-2026-99999 and were not used to broaden the KVM action.
Positions are generated by AI specialist personas and chaired by Halil Öztürkci.
Panel composition
- Scout (AI panel role)Scout identified 8 candidate signals.
- Linker (AI panel role)Linker evaluated 8 relation judgments.
- Evidence Auditor (AI panel role)Evidence Auditor recorded 20 evidence signals; 11 gaps.
- Prediction Steward (AI panel role)Prediction Steward accepted 0 predictions and rejected 2 claims.
- Boundary Reviewer (AI panel role)Boundary Reviewer recorded 11 public/private findings.
- Arbiter (AI panel role)Arbiter produced 8 decision envelopes.
Key disagreement
Scout (AI panel role)
No in-the-wild exploitation was established, and the available evidence did not verify the complete affected-version range or fixed kernel packages. | Merged related signal (candidate-9): What immediate action should be taken for internet-facing SiteGuard Server Edition systems potentially affected by CVE-2026-106931? | Merged related signal (candidate-10): What immediate action should be taken for internet-facing Nextcloud built-in CODE Server deployments potentially affected by CVE-2026-110447? | Merged related signal (candidate-11): How should organizations prioritize remediation of Apple CVE-2024-44308?
Arbiter outcome
Arbiter outcome: new decision record. The evidence supports a precautionary, trust-based containment decision for exposed KVM paths while affected versions and fixed builds remain uncertain.
Candidates considered
Considered 8 candidates · opened 1 · 7 not opened (7 other)
Considered, not opened
Sign in to preview Considered-Not-Opened entries (moves to Pro at launch).
Sign in to preview practitioner entries.
What is uncertain
MissingIt is not yet known which kernel or hypervisor versions are affected by CVE-2026-99999, which exact configurations expose the relevant guest-controlled path, or which vendor package can be treated as fixed.
The packet does not establish in-the-wild exploitation of CVE-2026-99999.
The reported active exploitation of CVE-2026-106931 in SiteGuard Server Edition, CVE-2026-110447 in Nextcloud built-in CODE Server, and CVE-2024-44308 on Intel-based Macs comes from separate handoff headlines and does not establish exploitation or exposure for KVM hosts.
What evidence is missing
MissingThe packet lacks an authoritative list of kernel and hypervisor versions affected by CVE-2026-99999, a configuration-level map of the relevant guest-controlled path, and vendor release or package evidence identifying a fixed build.
It also lacks captured primary evidence establishing in-the-wild exploitation of CVE-2026-99999.
Authoritative corroboration is likewise absent for the handoff headlines that label CVE-2026-106931 in SiteGuard Server Edition, CVE-2026-110447 in Nextcloud built-in CODE Server, and CVE-2024-44308 on Intel-based Macs as actively exploited.
These missing items prevent version-specific patch instructions and prevent the separate exploitation headlines from supporting the KVM decision.
What would change this
Under reviewConfirmed absence of the relevant guest-controlled path would reduce the priority of CVE-2026-99999 containment for that KVM host.
An authoritative affected-version map that excludes a host would also reduce its priority. Conversely, confirmed exploitation or confirmation that exposed multi-tenant KVM hosts are affected would justify a stronger and faster isolation response.
A vendor-identified fixed kernel build, followed by successful local canary testing, would allow operators to deploy the fix and then retire temporary containment controls.
Reports concerning CVE-2026-106931, CVE-2026-110447, or CVE-2024-44308 would not change this KVM decision unless new evidence directly connected them to the CVE-2026-99999 exposure assessment.
What to watch next
Under reviewWithin 72 hours, seek an authoritative mapping of CVE-2026-99999 to affected kernel and hypervisor versions, the configurations that expose the relevant guest-controlled path, and vendor package identifiers for fixed builds.
Canary-test any mapped fix before using deployment as the endpoint for containment. Increase priority immediately if exploitation of CVE-2026-99999 or affected multi-tenant exposure is confirmed. Reduce priority for a host only after verifying that the relevant path is absent.
Continue monitoring trusted-only KVM hosts for evidence involving that path. Track CVE-2026-106931, CVE-2026-110447, and CVE-2024-44308 separately; their reported exploitation must not be used as evidence that CVE-2026-99999 is being exploited.
Evidence basis
**0–2 hours:** Default priority is BeyondTrust first, but I challenge Pierre’s fixed ordering: **ConnectWise becomes first immediately** if Entra shows an unauthorized application secret, app-only access, role assignment, or Global Administ…
Public value history
- 19 Oct 2026Initial public guidanceCurrent guidance
Created the first public value version for this Decision Record.
Source RoundtableMorning roundtableConvened 19 Oct 2026Methodology
How the panel reaches a Public Decision Record.