EN PT-BR
← Voltar ao feed
critical healthcare finance cloud technology

Citrix Patches Critical XenServer Flaws (CVSS 9.8) Enabling Host Takeover and Guest Escape; Unicon Scout Brotli Bug Also Fixed

1 fonte(s) · 1 atualização(ões) · publicado 04/11/2026 21:06 · coletado há 1 hora

Cloud Software Group issued security bulletins on November 4, 2026, fixing multiple critical vulnerabilities in XenServer and Unicon eLux Scout thin-client management tools. The most severe flaw, CVE-2026-98432 (CVSS 9.8), is an IPv4 race condition that lets an unauthenticated attacker on the management network compromise the hypervisor host and any running Workload Balancing (WLB) or Conversion Manager appliances. A second flaw, CVE-2026-102703, allows a privileged guest VM user to break out and compromise the host. A cluster of pre-boot PXE firmware bugs, including CVE-2026-97631, enables remote code execution or secure boot bypass during VM network boot, alongside an OpenSSL flaw (CVE-2026-45447) and older EDK2 issues. Separately, the Unicon eLux Scout advisory patches CVE-2026-111497, a critical buffer overflow in Google's Brotli decoder affecting UniconOS Management (Scout) On-Prem and Scout Cloud Gateway. Citrix states it has seen no active exploitation of the XenServer flaws and no public exploit code exists, though it notes the Brotli flaw has been actively exploited elsewhere on the web.

Entenda a falha

A vulnerabilidade

The most severe flaw is CVE-2026-98432 (CVSS 9.8), an IPv4 bug in XenServer 8.4 and XenServer 9. An unauthenticated attacker on the management network can compromise the host and any running Workload Balancing (WLB) or Conversion Manager appliances. WLB before 2026.1.1 and Conversion Manager before 2026.2.0 are affected. CVE-2026-102703 lets a privileged user in a guest VM break out and compromise the host. CVE-2026-97631 belongs to a group of pre-boot PXE firmware bugs that give an attacker on the same network remote code execution or a secure boot bypass during VM network boot. The group also includes the OpenSSL flaw CVE-2026-45447 and older EDK2 issues. Separately, CVE-2026-111497 is a critical buffer overflow in Google's Brotli decoder, affecting UniconOS Management (Scout) On-Prem and Scout Cloud Gateway. A crafted compressed stream can corrupt memory or run code. Fixes: XenServer updates through the Early Access or Normal channels, WLB 2026.1.1, Conversion Manager 2026.2.0, Scout Hotfix 2609.1, 2508 CU2 LTSR, or Scout Cloud Gateway 1 2605.1-3.

Como funciona

For CVE-2026-98432, the XenServer host handles several IPv4 connection requests at the same time. During this concurrent handling, the code releases the socket options too early, while other work still uses them. The result is memory corruption on the management-facing host, which an attacker can turn into control of the host and of connected WLB or Conversion Manager appliances. For CVE-2026-111497, the Brotli decoder processes a compressed stream and does not check a return value, so it carries on after a failed step and can write memory incorrectly. The articles give no mechanism for the guest breakout or the PXE bugs beyond their effects.

Por que é vulnerável

CVE-2026-98432 is a race condition: socket options are freed prematurely when concurrent IPv4 connections are handled, which leaves memory in an unsafe state. CVE-2026-111497 comes from an unchecked return value in the Brotli decoder, so a failure goes unnoticed and memory gets corrupted. The articles do not give root causes for CVE-2026-102703 or the PXE and firmware bugs, and they do not say how the fixes change the code.

Como foi descoberta

The articles do not say who found the flaws or how. Cloud Software Group disclosed them through security bulletins on November 4, 2026, for XenServer and for Unicon eLux Scout. Citrix says it has seen no active exploitation of the XenServer flaws in customer networks, and the articles note that the Brotli flaw has been exploited in other software on the web. The securityonline.info header shows one flaw as exploited in the wild, but its text ties that to Brotli elsewhere, not to the XenServer bugs.

Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 23:16.

Detalhes técnicos

  • CVE-2026-98432: race condition in IPv4 connection handling frees socket options prematurely, causing memory corruption that enables host takeover.
  • CVE-2026-102703: guest VM isolation breakout allowing a privileged guest user to compromise the host.
  • CVE-2026-97631 and related PXE/firmware bugs allow pre-boot RCE or secure boot bypass over IPv4/IPv6 during VM network boot.
  • CVE-2026-111497 in Unicon eLux Scout stems from an unchecked return value in the Brotli decoder, allowing memory corruption or code execution via a crafted compressed stream.
  • Affected: XenServer 8.4 and XenServer 9; Workload Balancing before 2026.1.1; Conversion Manager before 2026.2.0; UniconOS Management (Scout) On-Prem and Scout Cloud Gateway.

Remediação

  • Update XenServer hosts via the Early Access or Normal update channels.
  • Update Workload Balancing to 2026.1.1 or later and Conversion Manager to 2026.2.0.
  • Apply Scout Hotfix 2609.1, 2508 CU2 LTSR, or Scout Cloud Gateway 1 2605.1-3.

Linha do tempo

  1. securityonline.info ↗ · pub. 04/11/2026 21:06 · coletado 04/11 23:00 primeiro registro

    Citrix Patches Critical XenServer Flaws (CVSS 9.8) Enabling Host Takeover and Guest Escape; Unicon Scout Brotli Bug Also Fixed

    ler a análise desta fonte

    Cloud Software Group issued security bulletins on November 4, 2026, fixing multiple critical vulnerabilities in XenServer and Unicon eLux Scout thin-client management tools. The most severe flaw, CVE-2026-98432 (CVSS 9.8), is an IPv4 race condition that lets an unauthenticated attacker on the management network compromise the hypervisor host and any running Workload Balancing (WLB) or Conversion Manager appliances. A second flaw, CVE-2026-102703, allows a privileged guest VM user to break out and compromise the host. A cluster of pre-boot PXE firmware bugs, including CVE-2026-97631, enables remote code execution or secure boot bypass during VM network boot, alongside an OpenSSL flaw (CVE-2026-45447) and older EDK2 issues. Separately, the Unicon eLux Scout advisory patches CVE-2026-111497, a critical buffer overflow in Google's Brotli decoder affecting UniconOS Management (Scout) On-Prem and Scout Cloud Gateway. Citrix states it has seen no active exploitation of the XenServer flaws and no public exploit code exists, though it notes the Brotli flaw has been actively exploited elsewhere on the web.

    Technical Details

    • CVE-2026-98432: race condition in IPv4 connection handling frees socket options prematurely, causing memory corruption that enables host takeover.
    • CVE-2026-102703: guest VM isolation breakout allowing a privileged guest user to compromise the host.
    • CVE-2026-97631 and related PXE/firmware bugs allow pre-boot RCE or secure boot bypass over IPv4/IPv6 during VM network boot.
    • CVE-2026-111497 in Unicon eLux Scout stems from an unchecked return value in the Brotli decoder, allowing memory corruption or code execution via a crafted compressed stream.
    • Affected: XenServer 8.4 and XenServer 9; Workload Balancing before 2026.1.1; Conversion Manager before 2026.2.0; UniconOS Management (Scout) On-Prem and Scout Cloud Gateway.

    Remediation

    • Update XenServer hosts via the Early Access or Normal update channels.
    • Update Workload Balancing to 2026.1.1 or later and Conversion Manager to 2026.2.0.
    • Apply Scout Hotfix 2609.1, 2508 CU2 LTSR, or Scout Cloud Gateway 1 2605.1-3.