Citrix XenServer 8.4/9 and Xen hypervisor (XSA-524 to XSA-532) vulnerabilities allow privilege escalation and data disclosure
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que a fonte trouxe em 13/11/2026 00:03; os links antigos trazem para cá.
Fontes: cert.cyber.gouv.fr ×2 ↗
CERT-FR (cert.cyber.gouv.fr) published two advisories on 2026-11-12 covering multiple vulnerabilities in the Xen hypervisor and in Citrix XenServer versions 8.4 and 9. The flaws allow privilege escalation, breaches of data confidentiality and bypass of security policies. The Xen advisories (XSA-524 through XSA-532) were released on 2026-11-10 and provide patches for Xen 4.17.x to 4.21.x and for the XAPI master component (cert.cyber.gouv.fr). For XenServer, CERT-FR points to the Citrix bulletin CTX697316 for patch information (cert.cyber.gouv.fr). Neither source reports active exploitation, public exploit code or attribution. Unpatched systems remain exposed to privilege elevation and loss of confidentiality.
Entenda a falha
A vulnerabilidade
Two CERT-FR advisories (CERTFR-2026-AVI-1502 and 1508) cover multiple flaws in Citrix XenServer and in the Xen hypervisor. For XenServer, the affected versions are 8.4 and 9 without the latest security patch; fixes are in Citrix bulletin CTX697316 of November 10, 2026. For Xen, the affected versions are 4.17.x to 4.21.x without the latest patch, Xen for Linux before xsa532-linux.patch, and all XAPI master versions without the latest update. The CVEs are CVE-2024-21963, CVE-2024-36350, CVE-2024-36357, CVE-2026-0004, CVE-2026-102705 to CVE-2026-102708, CVE-2026-119779, CVE-2026-119780, CVE-2026-99286 and CVE-2026-99287. CERT-FR says some of them allow privilege escalation, a breach of data confidentiality or a bypass of the security policy. The sources do not map impacts to CVEs, give CVSS scores or say what access an attacker needs.
Onde está
The sources name no file or function. The Xen fixes are in advisories XSA-524, 525, 529, 530, 531 and 532 (xenbits.xen.org/xsa), with patches such as xsa524.patch and xsa532-linux.patch; the XenServer fixes are in Citrix bulletin CTX697316.
Como foi descoberta
The sources do not say who found the flaws or how. The Xen project published its advisories and Citrix its bulletin CTX697316 on November 10, 2026, and CERT-FR issued its notices on November 12, 2026, pointing to the vendor documents for the fixes. The sources report no exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 13/11/2026 00:18.
Detalhes técnicos
- Affected products (XenServer): Citrix XenServer 8.4 and 9. CERT-FR stresses these are the XenServer virtualization platform, not the previously reported Citrix Secure Access Client vulnerabilities (cert.cyber.gouv.fr).
- Affected products (Xen): Xen versions prior to the fixed releases, spanning 4.17.x to 4.21.x, and all versions of XAPI master without the latest security updates (cert.cyber.gouv.fr).
- Impact: privilege escalation, data confidentiality compromise, security policy bypass (cert.cyber.gouv.fr).
- CVEs cited: CVE-2024-21963 appears in both advisories. The XenServer advisory also lists CVE-2024-36350 and CVE-2024-36357 plus several 2026 CVEs, which it does not enumerate in the source text. The Xen advisory cites CVE-2026-119780, among others (cert.cyber.gouv.fr).
- Per-CVE details, CVSS scores and attack prerequisites are not given in the sources.
Remediação
- Apply the Xen security patches for XSA-524 through XSA-532 (advisories dated 2026-11-10) and update XAPI master to the latest version (cert.cyber.gouv.fr).
- On XenServer 8.4 and 9, apply the updates described in Citrix bulletin CTX697316 (cert.cyber.gouv.fr).
- Prioritize hosts in multi-tenant or shared virtualization environments, since the flaws allow privilege escalation and security policy bypass.
Linha do tempo
-
Multiple Critical Vulnerabilities Discovered in Xen Affecting Data Confidentiality and Security Policies
ler a análise desta fonte ocultar
Multiple security vulnerabilities have been identified in several versions of Xen and its XAPI master component, enabling attackers to escalate privileges, breach data confidentiality, and bypass security policies. These flaws affect Xen versions prior to various released patches (notably XSA-524 through XSA-532) spanning versions 4.17.x to 4.21.x, and all versions of XAPI master without the latest security updates. The vulnerabilities are collectively tracked under several CVE identifiers, including CVE-2024-21963 and CVE-2026-119780, among others. Xen's security advisories from November 10, 2026, provide patches that address these issues, highlighting the importance for users to apply them promptly to mitigate risks associated with privilege elevation and data confidentiality compromises.
-
Multiple vulnerabilities including privilege escalation and data confidentiality issues in Citrix XenServer versions 8.4 and 9
ler a análise desta fonte ocultar
Multiple security vulnerabilities have been identified in Citrix XenServer versions 8.4 and 9, involving issues such as privilege escalation, data confidentiality breaches, and security policy bypass. While the specifics of each vulnerability are detailed across several CVEs (including CVE-2024-21963, CVE-2024-36350, CVE-2024-36357, and several from 2026), the advisory from CERT-FR refers to Citrix's official bulletin CTX697316 for patch information. These flaws can potentially allow attackers to elevate privileges and bypass security controls if systems are unpatched. Administrators are advised to apply the latest security updates to mitigate these risks. Notably, these affect XenServer virtualization platform versions rather than the previously reported Citrix Secure Access Client vulnerabilities.