EN PT-BR
← Voltar ao feed
medium

CERT-FR: Citrix XenServer 8.4 and 9 vulnerability allows security policy bypass (CVE-2026-114406)

1 fonte(s) · 1 atualização(ões) · publicado 25/10/2026 21:00 · coletado há 5 dias

CERT-FR published advisory CERTFR-2026-AVI-1384 on a vulnerability in Citrix XenServer, tracked as CVE-2026-114406. According to the advisory, an attacker could exploit it to bypass the security policy. It affects XenServer 8.4 and XenServer 9 without the latest security patch. The advisory is based on Citrix bulletin CTX697257 of 23 October 2026. It reports no active exploitation and gives no CVSS score or technical detail.

Entenda a falha

A vulnerabilidade

CVE-2026-114406 is a vulnerability in Citrix XenServer that lets an attacker bypass the security policy. CERT-FR lists XenServer 8.4 and XenServer 9 without the latest security patch as affected. The advisory does not describe the component, the attack conditions (network reach, authentication, user interaction), a CVSS score, or the exact fixed build. Defenders should apply the fixes in Citrix bulletin CTX697257.

Como foi descoberta

The CERT-FR advisory CERTFR-2026-AVI-1384, dated 26 October 2026, says only that a vulnerability was discovered in Citrix XenServer. It is based on Citrix bulletin CTX697257 of 23 October 2026. The articles do not say who found the flaw or how it was reported, and they report no exploitation in the wild.

Explicação gerada por IA a partir da matéria e dos artigos, em 27/10/2026 13:21.

Detalhes técnicos

  • Affected: XenServer 8.4 and XenServer 9 without the latest security patch.
  • Impact: security policy bypass.
  • Vendor bulletin: CTX697257 (23 October 2026).
  • No IOCs, threat actors or exploitation details are provided.

Remediação

  • Apply the fixes described in Citrix security bulletin CTX697257, as CERT-FR directs.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 25/10/2026 21:00 · coletado 27/10 13:01 primeiro registro

    CERT-FR: Citrix XenServer 8.4 and 9 vulnerability allows security policy bypass (CVE-2026-114406)

    ler a análise desta fonte

    CERT-FR published advisory CERTFR-2026-AVI-1384 on a vulnerability in Citrix XenServer, tracked as CVE-2026-114406. According to the advisory, an attacker could exploit it to bypass the security policy. It affects XenServer 8.4 and XenServer 9 without the latest security patch. The advisory is based on Citrix bulletin CTX697257 of 23 October 2026. It reports no active exploitation and gives no CVSS score or technical detail.

    Technical Details

    • Affected: XenServer 8.4 and XenServer 9 without the latest security patch.
    • Impact: security policy bypass.
    • Vendor bulletin: CTX697257 (23 October 2026).
    • No IOCs, threat actors or exploitation details are provided.

    Remediation

    • Apply the fixes described in Citrix security bulletin CTX697257, as CERT-FR directs.