EN PT-BR
← Voltar ao feed
high

Citrix XenServer 8.4/9 bulletin CTX697256 fixes critical host-takeover flaw CVE-2026-98432 and eight others; Scout Brotli bug in CTX697300

3 fonte(s) · 3 atualização(ões) · publicado 03/11/2026 21:00 · coletado há 14 horas

Matéria consolidada. Reúne 4 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 07/11/2026 00:05; os links antigos trazem para cá.

Fontes: cert.cyber.gouv.fr ↗ gbhackers.com ↗ securityonline.info ↗

Cloud Software Group (Citrix) published security bulletin CTX697256 for XenServer 8.4 and XenServer 9, rated Critical and covering nine CVEs. The lead flaw, CVE-2026-98432, may let an unauthenticated attacker on the management network compromise the host and any Workload Balancing (WLB) or Conversion Manager appliances. CERT-FR (cert.cyber.gouv.fr) relays CTX697256 and the separate bulletin CTX697300 as Citrix bulletins of November 3, 2026. That matches the date given by gbhackers.com; securityonline.info gave November 4, 2026. CTX697300 covers Unicon eLux Scout, where CVE-2026-111497, a Google Brotli decoder flaw, is fixed. CERT-FR says the flaws allow remote arbitrary code execution and privilege escalation (cert.cyber.gouv.fr). No active exploitation against customers is confirmed, and no public exploit code is reported (securityonline.info). The CERT-FR bulletin does not state any exploitation either (cert.cyber.gouv.fr). The press sources worked from the articles alone, and CERT-FR only relays the bulletins without mapping CVEs to products, so the details of CVE-2026-98432 remain unverified. HKCERT rated the bulletin Medium, listing denial of service and security restriction bypass as impacts (gbhackers.com).

Entenda a falha

A vulnerabilidade

Cloud Software Group bulletin CTX697256 (Critical, dated November 3 per CERT-FR and gbhackers.com) covers nine CVEs in XenServer 8.4 and 9. The worst, CVE-2026-98432, may let an unauthenticated attacker on the management network compromise the host and any Workload Balancing (before 2026.1.1) or Conversion Manager (before 2026.2.0) appliance. securityonline.info gives it CVSS 9.8, but gbhackers.com says the bulletin gives no score and that 9.8 belongs to a Linux kernel IPv4 use-after-free with the same ID, so treat the score as unconfirmed. CVE-2026-102703 lets a privileged guest VM user compromise the host. CVE-2026-97631, CVE-2026-45447 and four older EDK2 CVEs let a same-network attacker compromise a PXE-booting VM, or a guest admin bypass secure boot. CVE-2026-111497, a Brotli flaw in Unicon eLux Scout, is in the separate bulletin CTX697300, as CERT-FR confirms. It is fixed by patch 2609.1, 2508 CU2 LTSR or SCG 2605.1-3.

Como funciona

For CVE-2026-98432, securityonline.info says that when the host handles concurrent IPv4 connection requests, a race condition frees socket options too early, and the resulting memory corruption lets the attacker take over the host. gbhackers.com says the bulletin gives no root cause, so this is one outlet's account. The attacker only needs to reach the management network, with no login. For CVE-2026-102703, the attacker already holds administrator rights inside a guest and crosses the isolation boundary into the host. The PXE flaws sit in the early network-boot stage of a VM, over IPv4 or IPv6, before the guest OS loads. For CVE-2026-111497, a crafted Brotli-compressed stream is decoded and an unchecked return value leads to memory corruption or code execution.

Por que é vulnerável

For CVE-2026-98432, securityonline.info points to an IPv4 race condition that frees socket options prematurely, a use-after-free style memory corruption. gbhackers.com says Citrix gave no root cause and has not said whether it relates to the Linux kernel IPv4 use-after-free with the same identifier, so no link should be assumed. No cause is given for CVE-2026-102703. The PXE group mixes an OpenSSL issue and older EDK2 firmware bugs. The only clearly stated cause is for CVE-2026-111497: an unchecked return value in Google's Brotli decoder. The fix is to install the patched releases.

Como foi descoberta

The articles do not say who found the flaws or how. Cloud Software Group (Citrix) disclosed them in bulletins CTX697256 and CTX697300, both dated November 3 by CERT-FR, which relayed them in CERTFR-2026-AVI-1449 on November 4. securityonline.info says Citrix confirmed no attacks against customers for the XenServer flaws and that the Brotli flaw has been exploited in other software on the web. gbhackers.com and CERT-FR state no exploitation. HKCERT rated the bulletin Medium (denial of service, security restriction bypass), against Citrix's Critical. The outlets worked from the bulletin text alone.

Explicação gerada por IA a partir da matéria e dos artigos, em 07/11/2026 00:20.

Detalhes técnicos

  • CVE-2026-98432: affects XenServer 8.4 and 9, Workload Balancing before 2026.1.1 and Conversion Manager before 2026.2.0. securityonline.info describes it as an IPv4 race condition in which concurrent connection requests free socket options too early, causing memory corruption and host takeover. gbhackers.com says the bulletin gives no root cause (see Conflicting Reports).
  • CVE-2026-102703: a privileged user in a guest VM may compromise the host, breaking VM isolation (guest escape). The risk is highest in multi-tenant and hosting environments (gbhackers.com).
  • Six CVEs cover network boot and secure boot: CVE-2026-97631 (pre-boot remote code execution during PXE boot over IPv4 or IPv6), CVE-2026-45447 (OpenSSL), CVE-2024-38797, CVE-2024-38796, CVE-2022-36764 and CVE-2022-36763 (older EDK2 bugs). An unauthenticated attacker on the same network may compromise a PXE-booting VM during early boot, and a guest VM administrator may bypass the guest's secure boot policy.
  • CVE-2026-111497: a buffer overflow in Google's Brotli decoder caused by an unchecked return value. A crafted compressed stream can corrupt memory or execute code. It affects UniconOS Management (Scout) On-Prem and Scout Cloud Gateway (securityonline.info). gbhackers.com says it is covered by a separate Critical bulletin, CTX697300. CERT-FR confirms the separate bulletin: CTX697300 is titled as a Citrix Security Advisory for CVE-2026-111497 with impact on Unicon eLux Scout, and CERT-FR names the CVE only through that title (cert.cyber.gouv.fr).
  • Severity split across all the bulletins: 3 critical, 3 high and 3 medium (securityonline.info).
  • CERT-FR bulletin CERTFR-2026-AVI-1449 lists nine CVEs: CVE-2022-36763, CVE-2022-36764, CVE-2024-38796, CVE-2024-38797, CVE-2026-102703, CVE-2026-111497, CVE-2026-45447, CVE-2026-97631 and CVE-2026-98432. It gives no CVSS scores, prerequisites, per-CVE product mapping or exploitation status (cert.cyber.gouv.fr).
  • Affected products per CERT-FR: Scout Cloud Gateway (SCG) On-Prem without security patch 2605.1-3; UniconOS Management (Scout) On-Prem without security patch 2609.1; Scout LTSR without security patch 2508 CU2 LTSR; XenServer 8.4 and 9 with Workload Balancing earlier than 2026.1.1 and Conversion Manager earlier than 2026.2.0 (cert.cyber.gouv.fr).

Remediação

  • Update XenServer 8.4 and 9 hosts to the latest version through the Early Access or Normal channel.
  • Update Workload Balancing to 2026.1.1 or later and Conversion Manager to 2026.2.0 or later (also cert.cyber.gouv.fr).
  • For Scout, apply Hotfix 2609.1, 2508 CU2 LTSR, or Scout Cloud Gateway 1 2605.1-3 (securityonline.info). CERT-FR lists the same fixes: SCG security patch 2605.1-3, UniconOS Management security patch 2609.1 and Scout LTSR security patch 2508 CU2 LTSR, from bulletins CTX697256 and CTX697300 (cert.cyber.gouv.fr).
  • Patch management-plane hosts first, and restrict management network access to trusted administrative systems (gbhackers.com).
  • Audit who holds administrator rights inside guest VMs, and review PXE boot segments and secure boot configurations (gbhackers.com).

Relatos divergentes

  • CVSS and root cause of CVE-2026-98432: securityonline.info reports CVSS 9.8 and an IPv4 race condition. gbhackers.com, the more recent source, says the bulletin gives no CVSS score or root cause. It says the 9.8 score belongs to a Linux kernel IPv4 TCP use-after-free that has the same CVE ID, and that Citrix has not said whether the two are related. CERT-FR gives no score or root cause either (cert.cyber.gouv.fr). Treat the 9.8 score and the race-condition description as unconfirmed.
  • Exploitation: the securityonline.info header says 1 of 9 flaws is exploited in the wild. Its body says Citrix confirmed no attacks against customers for the XenServer flaws, and the header appears to refer to the Brotli flaw being exploited in other software. gbhackers.com says the bulletin does not mention exploitation, and CERT-FR states no exploitation in the wild (cert.cyber.gouv.fr).
  • Publication date: November 4, 2026 (securityonline.info) versus November 3, 2026 (gbhackers.com, which also gives the bulletin ID). CERT-FR dates the Citrix bulletins November 3, 2026 (cert.cyber.gouv.fr), so November 3 is better supported; November 4 is the date of the CERT-FR bulletin.
  • Brotli flaw scope: securityonline.info presents it as part of the same set of bulletins. gbhackers.com says it belongs to the separate bulletin CTX697300, and CERT-FR confirms CTX697300 as a separate bulletin (cert.cyber.gouv.fr).
  • Severity: Citrix rates the bulletin Critical, while HKCERT rated it Medium (gbhackers.com).

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 03/11/2026 21:00 · coletado 06/11 12:00

    CERT-FR relays Citrix advisories for multiple flaws in Scout, UniconOS Management and XenServer, including RCE and privilege escalation

    ler a análise desta fonte

    CERT-FR bulletin CERTFR-2026-AVI-1449 relays two Citrix security bulletins of 3 November 2026: CTX697256 (XenServer Security Update for Multiple Issues) and CTX697300 (Citrix Security Advisory for CVE-2026-111497, impact on Unicon eLux Scout). CERT-FR says the flaws allow remote arbitrary code execution and privilege escalation. The affected products are Scout Cloud Gateway (SCG) On-Prem, UniconOS Management (Scout) On-Prem and XenServer 8.4 and 9. The bulletin does not map each CVE to a product. It also gives no CVSS scores, prerequisites or exploitation status.

    Technical Details

    • The CVEs listed are CVE-2022-36763, CVE-2022-36764, CVE-2024-38796, CVE-2024-38797, CVE-2026-102703, CVE-2026-111497, CVE-2026-45447, CVE-2026-97631 and CVE-2026-98432 (cert.cyber.gouv.fr).
    • CERT-FR names CVE-2026-111497 only through the title of Citrix bulletin CTX697300, which concerns Unicon eLux Scout (cert.cyber.gouv.fr).
    • Affected: SCG On-Prem without security patch 2605.1-3; UniconOS Management (Scout) On-Prem without security patch 2609.1; Scout LTSR without security patch 2508 CU2 LTSR; XenServer 8.4 and 9 with Workload Balancing earlier than 2026.1.1 and Conversion Manager earlier than 2026.2.0 (cert.cyber.gouv.fr).
    • The bulletin does not state any exploitation in the wild.

    Remediation

    Apply the fixes listed in Citrix bulletins CTX697256 and CTX697300: SCG security patch 2605.1-3, UniconOS Management security patch 2609.1, Scout LTSR security patch 2508 CU2 LTSR, Workload Balancing 2026.1.1 or later, and Conversion Manager 2026.2.0 or later (cert.cyber.gouv.fr).

  2. gbhackers.com ↗ · pub. 05/11/2026 05:46 · coletado 05/11 06:00

    Citrix XenServer 8.4 and 9 bulletin CTX697256 fixes critical unauthenticated host takeover (CVE-2026-98432) and eight other flaws

    The article gives the bulletin ID (CTX697256) and a publication date of November 3. It also lists the full set of nine CVEs, including the older EDK2/OpenSSL-related ones. It says the bulletin gives no CVSS or root cause for CVE-2026-98432, and that the 9.8 score belongs to a Linux kernel CVE with the same ID. It adds that HKCERT rated the bulletin Medium and that the bulletin does not mention exploitation. This contradicts the earlier report's CVSS 9.8 and race-condition description.

    ler a análise desta fonte

    The article gives the bulletin ID (CTX697256) and a publication date of November 3. It also lists the full set of nine CVEs, including the older EDK2/OpenSSL-related ones. It says the bulletin gives no CVSS or root cause for CVE-2026-98432, and that the 9.8 score belongs to a Linux kernel CVE with the same ID. It adds that HKCERT rated the bulletin Medium and that the bulletin does not mention exploitation. This contradicts the earlier report's CVSS 9.8 and race-condition description.

    Cloud Software Group (Citrix) published bulletin CTX697256 on November 3, 2026. It rates the update Critical and covers nine CVEs in XenServer 8.4 and XenServer 9. The most severe, CVE-2026-98432, may let an unauthenticated attacker on the management network compromise the host and any Workload Balancing (WLB) or Conversion Manager appliances. The bulletin gives no CVSS score, no root cause and no sign of active exploitation. HKCERT rated the bulletin Medium, listing denial of service and security restriction bypass as impacts. This report is based on the article alone, because no vendor page was checked.

    Technical Details

    • CVE-2026-98432: affects XenServer 8.4 and 9, Workload Balancing before 2026.1.1 and Conversion Manager before 2026.2.0. The article notes the same ID is also used for a Linux kernel IPv4 TCP use-after-free (CVSS 9.8). Citrix has not said whether the two are related.
    • CVE-2026-102703: a privileged user inside a guest VM may compromise the host, breaking VM isolation. The risk is highest in multi-tenant and hosting environments.
    • Six CVEs cover network boot and secure boot: CVE-2026-97631, CVE-2026-45447, CVE-2024-38797, CVE-2024-38796, CVE-2022-36764 and CVE-2022-36763. An unauthenticated attacker on the same network may compromise a PXE-booting VM during early boot. A guest VM administrator may bypass the guest's secure boot policy.
    • A separate Critical bulletin, CTX697300, covers CVE-2026-111497, a Google Brotli unchecked return value flaw that affects Unicon eLux Scout.

    Remediation

    • Update through the Early Access or Normal channel to the latest version for XenServer 8.4 and 9.
    • Update Workload Balancing to 2026.1.1 or later and Conversion Manager to 2026.2.0 or later, from the XenServer downloads page.
    • Patch management-plane hosts first.
    • Restrict management network access to trusted administrative systems.
    • Audit who holds administrator rights inside guest VMs.
    • Review PXE boot segments and secure boot configurations.
  3. securityonline.info ↗ · pub. 04/11/2026 21:06 · coletado 04/11 23:00 primeiro registro

    Citrix XenServer and Unicon eLux Scout patches fix critical host takeover (CVE-2026-98432, CVSS 9.8), guest escape and PXE flaws

    ler a análise desta fonte

    On November 4, 2026, Cloud Software Group published security bulletins for XenServer and Unicon eLux Scout. The bulletins cover 9 flaws: 3 critical, 3 high and 3 medium. The top flaw is CVE-2026-98432, an IPv4 race condition (CVSS 9.8). An unauthenticated attacker on the management network could use it to compromise the host and any Workload Balancing (WLB) or Conversion Manager appliances. The article says Citrix confirmed no active attacks against customers for the XenServer flaws and that no public exploit code exists. The article's header does say 1 of 9 flaws is exploited in the wild. That appears to refer to the Brotli flaw, which the article says attackers have exploited in other software. This report is based on the article alone, because no vendor advisory was checked.

    Technical Details

    • CVE-2026-98432: concurrent IPv4 connection requests cause a race that frees socket options too early. The resulting memory corruption allows host takeover. It also affects Workload Balancing before 2026.1.1 and Conversion Manager before 2026.2.0.
    • CVE-2026-102703: a privileged user in a guest VM can compromise the host (guest escape).
    • CVE-2026-97631: pre-boot remote code execution during PXE boot over IPv4 or IPv6. It belongs to a firmware cluster that also includes CVE-2026-45447 (OpenSSL) and older EDK2 bugs. An attacker on the same network can compromise a booting VM or bypass secure boot.
    • CVE-2026-111497: a buffer overflow in Google's Brotli decoder, caused by an unchecked return value. A crafted compressed stream can corrupt memory or execute code. It affects UniconOS Management (Scout) On-Prem and Scout Cloud Gateway.
    • Affected: XenServer 8.4 and XenServer 9.

    Remediation

    • Update XenServer hosts through the Early Access or Normal channels.
    • Update Workload Balancing to 2026.1.1 or later and Conversion Manager to 2026.2.0.
    • For Scout, apply Hotfix 2609.1, 2508 CU2 LTSR, or Scout Cloud Gateway 1 2605.1-3.