Citrix Patches Critical XenServer Flaws Allowing Unauthenticated Host Takeover
Citrix (Cloud Software Group) released bulletin CTX697256 on November 3, 2026, patching nine CVEs affecting XenServer 8.4 and 9, rated Critical by Citrix. The most severe, CVE-2026-98432, may allow an unauthenticated attacker on the management network to compromise the virtualization host as well as any running Workload Balancing (WLB) or Conversion Manager appliances; no CVSS score or root cause was disclosed, and Citrix has not confirmed any relation to the identically numbered Linux kernel IPv4 use-after-free bug. A second flaw, CVE-2026-102703, could let a privileged guest VM user break isolation and compromise the host, posing particular risk in multi-tenant hosting environments. Six additional CVEs affect PXE network booting and secure boot, potentially allowing network attackers to compromise PXE-booting VMs or guest admins to bypass secure boot. Notably, HKCERT rated the bulletin only Medium risk citing denial of service and security restriction bypass, conflicting with Citrix's Critical classification; no active exploitation has been reported.
Entenda a falha
A vulnerabilidade
Citrix bulletin CTX697256 (November 3, 2026) fixes nine CVEs in XenServer 8.4 and 9, rated Critical by Citrix. The worst, CVE-2026-98432, may let an unauthenticated attacker on the management network compromise the host and any Workload Balancing or Conversion Manager appliance; it also affects Workload Balancing before 2026.1.1 and Conversion Manager before 2026.2.0. CVE-2026-102703 may let a privileged user in a guest VM break isolation and compromise the host, a particular risk for multi-tenant hosting. Six more CVEs (CVE-2026-97631, CVE-2026-45447, CVE-2024-38797, CVE-2024-38796, CVE-2022-36764, CVE-2022-36763) affect PXE boot and secure boot: a same-network attacker could compromise a PXE-booting VM, or a guest admin could bypass secure boot policy. A separate bulletin, CTX697300, covers CVE-2026-111497, a Brotli unchecked return value flaw in Unicon eLux Scout. Fixes are in the latest XenServer releases of the Early Access and Normal channels.
Como funciona
The articles do not describe how the vulnerable code works. What they say is that, for CVE-2026-98432, the attacker only needs to reach the XenServer management network, with no login, and from there can compromise the host and connected WLB or Conversion Manager appliances. For CVE-2026-102703, the attacker already holds administrator rights inside a guest VM and crosses the boundary to the host. For the PXE flaws, the exposure is the early network-boot stage of a VM. The exact step where each goes wrong was not disclosed.
Por que é vulnerável
Citrix did not disclose a root cause for CVE-2026-98432 or the other XenServer CVEs, and no CVSS score was given. Citrix has not said whether CVE-2026-98432 is related to a Linux kernel IPv4 use-after-free bug with the same identifier, so no connection should be assumed. The only cause named is for CVE-2026-111497, an unchecked return value in Google Brotli. The fix is to update to the patched releases.
Como foi descoberta
The articles do not say who found the flaws or how. Citrix (Cloud Software Group) disclosed them in bulletin CTX697256 on November 3, 2026, and no active exploitation has been reported. HKCERT rated the bulletin Medium risk, citing denial of service and security restriction bypass, which differs from Citrix's Critical rating.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 06:16.
Detalhes técnicos
All nine CVEs affect XenServer 8.4 and XenServer 9; CVE-2026-98432 additionally affects Workload Balancing before 2026.1.1 and Conversion Manager before 2026.2.0. The PXE/secure-boot group comprises CVE-2026-97631, CVE-2026-45447, CVE-2024-38797, CVE-2024-38796, CVE-2022-36764, CVE-2022-36763. A separate Critical bulletin, CTX697300, addresses CVE-2026-111497, a Google Brotli unchecked return value flaw affecting Unicon eLux Scout.
Remediação
Citrix has pushed fixes to Early Access and Normal update channels for both XenServer versions and recommends updating to the latest release, plus upgrading Workload Balancing to 2026.1.1+ and Conversion Manager to 2026.2.0+. Administrators should patch management-plane hosts first, restrict management network access to trusted systems, audit guest VM administrator rights, and review PXE boot segments and secure boot configurations.
Linha do tempo
-
Citrix Patches Critical XenServer Flaws Allowing Unauthenticated Host Takeover
ler a análise desta fonte ocultar
Citrix (Cloud Software Group) released bulletin CTX697256 on November 3, 2026, patching nine CVEs affecting XenServer 8.4 and 9, rated Critical by Citrix. The most severe, CVE-2026-98432, may allow an unauthenticated attacker on the management network to compromise the virtualization host as well as any running Workload Balancing (WLB) or Conversion Manager appliances; no CVSS score or root cause was disclosed, and Citrix has not confirmed any relation to the identically numbered Linux kernel IPv4 use-after-free bug. A second flaw, CVE-2026-102703, could let a privileged guest VM user break isolation and compromise the host, posing particular risk in multi-tenant hosting environments. Six additional CVEs affect PXE network booting and secure boot, potentially allowing network attackers to compromise PXE-booting VMs or guest admins to bypass secure boot. Notably, HKCERT rated the bulletin only Medium risk citing denial of service and security restriction bypass, conflicting with Citrix's Critical classification; no active exploitation has been reported.
Technical Details
All nine CVEs affect XenServer 8.4 and XenServer 9; CVE-2026-98432 additionally affects Workload Balancing before 2026.1.1 and Conversion Manager before 2026.2.0. The PXE/secure-boot group comprises CVE-2026-97631, CVE-2026-45447, CVE-2024-38797, CVE-2024-38796, CVE-2022-36764, CVE-2022-36763. A separate Critical bulletin, CTX697300, addresses CVE-2026-111497, a Google Brotli unchecked return value flaw affecting Unicon eLux Scout.
Remediation
Citrix has pushed fixes to Early Access and Normal update channels for both XenServer versions and recommends updating to the latest release, plus upgrading Workload Balancing to 2026.1.1+ and Conversion Manager to 2026.2.0+. Administrators should patch management-plane hosts first, restrict management network access to trusted systems, audit guest VM administrator rights, and review PXE boot segments and secure boot configurations.