/
← Voltar ao feed
high

CERT-FR: Multiple Citrix vulnerabilities in XenServer, Workspace app for Windows and UniconOS allow code execution, privilege escalation and DoS

1 fonte(s) · 1 atualização(ões) · publicado 13/10/2026 21:00 · coletado há 12 horas

CERT-FR advisory CERTFR-2026-AVI-1310 reports multiple vulnerabilities in Citrix products, based on Citrix security bulletins dated 13 October 2026. According to the advisory, some flaws allow an attacker to achieve arbitrary code execution, privilege escalation and remote denial of service. Other listed impacts are data integrity and confidentiality breaches and security policy bypass. The affected products are XenServer, Citrix Workspace app for Windows and UniconOS. The advisory does not state whether any flaw is exploited in the wild and gives no technical detail or attribution.

Technical Details

  • XenServer 8.4 and 9 without the latest security patch (bulletin CTX697170, covering CVE-2026-79610, CVE-2026-102700 and CVE-2026-102701).
  • Citrix Workspace app for Windows before 2507 CU3 Hotfix 1, before 2603.20 and before 2607 Hotfix 1 (bulletin CTX697181, covering CVE-2026-84419 and CVE-2026-84420).
  • UniconOS before 2603 LTSR CU2 and before 2607.2 (bulletin CTX697187, covering CVE-2026-53562, CVE-2026-53563 and CVE-2026-53564).
  • The advisory gives no per-CVE severity, IOCs or exploitation status.

Remediation

  • Consult Citrix bulletins CTX697170, CTX697181 and CTX697187 and apply the fixed versions and patches listed there.
  • Update XenServer hosts, Workspace app for Windows clients and UniconOS endpoints to the fixed releases.

Linha do tempo

  1. cert.ssi.gouv.fr ↗ · pub. 13/10/2026 21:00 · coletado 20/10 16:32 primeiro registro

    CERT-FR: Multiple Citrix vulnerabilities in XenServer, Workspace app for Windows and UniconOS allow code execution, privilege escalation and DoS

    ler a análise desta fonte

    CERT-FR advisory CERTFR-2026-AVI-1310 reports multiple vulnerabilities in Citrix products, based on Citrix security bulletins dated 13 October 2026. According to the advisory, some flaws allow an attacker to achieve arbitrary code execution, privilege escalation and remote denial of service. Other listed impacts are data integrity and confidentiality breaches and security policy bypass. The affected products are XenServer, Citrix Workspace app for Windows and UniconOS. The advisory does not state whether any flaw is exploited in the wild and gives no technical detail or attribution.

    Technical Details

    • XenServer 8.4 and 9 without the latest security patch (bulletin CTX697170, covering CVE-2026-79610, CVE-2026-102700 and CVE-2026-102701).
    • Citrix Workspace app for Windows before 2507 CU3 Hotfix 1, before 2603.20 and before 2607 Hotfix 1 (bulletin CTX697181, covering CVE-2026-84419 and CVE-2026-84420).
    • UniconOS before 2603 LTSR CU2 and before 2607.2 (bulletin CTX697187, covering CVE-2026-53562, CVE-2026-53563 and CVE-2026-53564).
    • The advisory gives no per-CVE severity, IOCs or exploitation status.

    Remediation

    • Consult Citrix bulletins CTX697170, CTX697181 and CTX697187 and apply the fixed versions and patches listed there.
    • Update XenServer hosts, Workspace app for Windows clients and UniconOS endpoints to the fixed releases.