Multiple vulnerabilities including privilege escalation and data confidentiality issues in Citrix XenServer versions 8.4 and 9
Multiple security vulnerabilities have been identified in Citrix XenServer versions 8.4 and 9, involving issues such as privilege escalation, data confidentiality breaches, and security policy bypass. While the specifics of each vulnerability are detailed across several CVEs (including CVE-2024-21963, CVE-2024-36350, CVE-2024-36357, and several from 2026), the advisory from CERT-FR refers to Citrix's official bulletin CTX697316 for patch information. These flaws can potentially allow attackers to elevate privileges and bypass security controls if systems are unpatched. Administrators are advised to apply the latest security updates to mitigate these risks. Notably, these affect XenServer virtualization platform versions rather than the previously reported Citrix Secure Access Client vulnerabilities.
Entenda a falha
A vulnerabilidade
Citrix XenServer 8.4 and 9 have multiple vulnerabilities. According to CERT-FR, some of them allow an attacker to escalate privileges, breach data confidentiality or bypass the security policy. The listed CVEs are CVE-2024-21963, CVE-2024-36350, CVE-2024-36357, CVE-2026-102705 to CVE-2026-102708, CVE-2026-119779 and CVE-2026-119780. The articles do not say which impact belongs to which CVE, nor what access an attacker needs. Affected systems are XenServer 8.4 and 9 without the latest security patch. The fixes are in Citrix bulletin CTX697316 of 10 November 2026.
Como foi descoberta
The articles do not say who found the flaws or how. They only report that Citrix published the security bulletin CTX697316 on 10 November 2026 and that CERT-FR issued advisory CERTFR-2026-AVI-1502 pointing to it for the patches. CERT-FR marks the vendor's information on workarounds or exploitation as unspecified.
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 13:28.
Linha do tempo
-
Multiple vulnerabilities including privilege escalation and data confidentiality issues in Citrix XenServer versions 8.4 and 9
ler a análise desta fonte ocultar
Multiple security vulnerabilities have been identified in Citrix XenServer versions 8.4 and 9, involving issues such as privilege escalation, data confidentiality breaches, and security policy bypass. While the specifics of each vulnerability are detailed across several CVEs (including CVE-2024-21963, CVE-2024-36350, CVE-2024-36357, and several from 2026), the advisory from CERT-FR refers to Citrix's official bulletin CTX697316 for patch information. These flaws can potentially allow attackers to elevate privileges and bypass security controls if systems are unpatched. Administrators are advised to apply the latest security updates to mitigate these risks. Notably, these affect XenServer virtualization platform versions rather than the previously reported Citrix Secure Access Client vulnerabilities.