EN PT-BR
← Voltar ao feed
critical healthcare finance cloud technology media

Citrix patches critical XenServer flaws (CVE-2026-98432, CVE-2026-102703) enabling host takeover and guest escape; Unicon eLux Scout Brotli bug also fixed

3 fonte(s) · 3 atualização(ões) · publicado 04/11/2026 21:06 · coletado há 1 hora

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 06/11/2026 06:01; os links antigos trazem para cá.

Fontes: helpnetsecurity.com ↗ gbhackers.com ↗ securityonline.info ↗

Cloud Software Group (Citrix) released security bulletins in early November 2026 fixing multiple critical vulnerabilities in XenServer 8.4 and XenServer 9, plus a separate flaw in Unicon eLux Scout. The most severe, CVE-2026-98432, may let an unauthenticated attacker on the management network compromise the hypervisor host and any running Workload Balancing (WLB) or Conversion Manager appliances (securityonline.info, gbhackers.com). A second flaw, CVE-2026-102703, lets a privileged guest VM user break isolation and compromise the host, which is a particular risk in multi-tenant hosting (gbhackers.com). A group of PXE and secure boot bugs, including CVE-2026-97631, adds further exposure during VM network boot. Citrix reports no active exploitation of the XenServer flaws and no public exploit code (securityonline.info); gbhackers.com likewise reports no exploitation. The separate Unicon bulletin covers CVE-2026-111497, a critical Google Brotli decoder flaw that securityonline.info says has been actively exploited elsewhere on the web.

Entenda a falha

A vulnerabilidade

Citrix bulletin CTX697256 (dated November 3 per gbhackers.com, November 4 per securityonline.info) fixes nine CVEs in XenServer 8.4 and 9. The worst, CVE-2026-98432, may let an unauthenticated attacker on the management network compromise the host and any Workload Balancing or Conversion Manager appliance. It also affects Workload Balancing before 2026.1.1 and Conversion Manager before 2026.2.0. securityonline.info gives it CVSS 9.8, but gbhackers.com says no score was published. CVE-2026-102703 lets a privileged user in a guest VM break isolation and compromise the host. Six PXE and secure boot CVEs (CVE-2026-97631, CVE-2026-45447 and four older EDK2 ones) allow a same-network attacker to compromise a PXE-booting VM, or a guest admin to bypass secure boot. Separately, CTX697300 fixes CVE-2026-111497, a critical Brotli flaw in Unicon eLux Scout (Scout On-Prem and Scout Cloud Gateway). Fixes: the latest XenServer builds in the Early Access or Normal channels, Scout Hotfix 2609.1, 2508 CU2 LTSR or Cloud Gateway 2605.1-3.

Como funciona

For CVE-2026-98432, securityonline.info says that when the host handles concurrent IPv4 connection requests, a race condition frees the socket options too early, and the resulting memory corruption lets the attacker take over the host. gbhackers.com says Citrix disclosed no root cause, so this description is one outlet's account. The attacker only needs to reach the management network, with no login. For CVE-2026-102703, the attacker already has administrator rights inside a guest and crosses the boundary into the host. The PXE flaws sit in the early network-boot stage of a VM, over IPv4 or IPv6, before the guest OS loads. For CVE-2026-111497, a crafted Brotli-compressed stream is decoded and an unchecked return value leads to memory corruption or code execution.

Por que é vulnerável

The sources disagree on CVE-2026-98432: securityonline.info points to an IPv4 race condition that frees socket options prematurely (a use-after-free style memory corruption), while gbhackers.com says Citrix gave no root cause. Citrix has not said whether it relates to the Linux kernel IPv4 use-after-free with the same identifier, so no link should be assumed. No cause is given for CVE-2026-102703. The PXE group mixes an OpenSSL issue and older EDK2 firmware bugs. The only clearly stated cause is for CVE-2026-111497: an unchecked return value in Google's Brotli decoder. The fix is to install the patched releases.

Como foi descoberta

The articles do not say who found the XenServer flaws or how. Cloud Software Group (Citrix) disclosed them in bulletin CTX697256 and the separate CTX697300, and Citrix reports no exploitation of the XenServer flaws. HKCERT rated the bulletin only Medium (denial of service and security restriction bypass), against Citrix's Critical. securityonline.info says the Brotli flaw has been exploited in other software on the web, while Help Net Security says that for the .NET Brotli fix (Microsoft, October 25) there is a PoC but no known exploitation. gbhackers.com says nine CVEs are fixed but names only eight.

PoC pública

For the XenServer flaws (CVE-2026-98432, CVE-2026-102703 and the PXE group), Citrix and securityonline.info say no public exploit code exists. For the Brotli flaw CVE-2026-111497, Help Net Security says proof-of-concept code is available, in the context of Microsoft's .NET emergency fix; it does not describe its maturity or give an address, and it does not tie the PoC to Unicon eLux Scout. Treat Scout patching as urgent, given the PoC and the report of exploitation elsewhere.

Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 06:16.

Detalhes técnicos

  • CVE-2026-98432: described as an IPv4 connection-handling race condition that frees socket options prematurely, causing memory corruption and host takeover (securityonline.info). It also affects Workload Balancing before 2026.1.1 and Conversion Manager before 2026.2.0 (gbhackers.com). Citrix has not confirmed any relation to the identically numbered Linux kernel IPv4 use-after-free bug (gbhackers.com).
  • CVE-2026-102703: guest VM isolation breakout by a privileged guest user, leading to host compromise.
  • PXE and secure boot group: CVE-2026-97631, CVE-2026-45447 (OpenSSL), CVE-2024-38797, CVE-2024-38796, CVE-2022-36764 and CVE-2022-36763 (the last four are older EDK2 issues per securityonline.info). They can allow remote code execution or secure boot bypass during VM network boot over IPv4/IPv6. Per gbhackers.com, network attackers could compromise PXE-booting VMs and guest admins could bypass secure boot.
  • CVE-2026-111497 (bulletin CTX697300): unchecked return value in the Brotli decoder, allowing memory corruption or code execution via a crafted compressed stream. Affects UniconOS Management (Scout) On-Prem and Scout Cloud Gateway.
  • Affected: XenServer 8.4 and XenServer 9, per the CTX697256 bulletin cited by gbhackers.com.

Remediação

  • Update XenServer hosts through the Early Access or Normal update channels, and move to the latest release.
  • Upgrade Workload Balancing to 2026.1.1 or later and Conversion Manager to 2026.2.0 or later.
  • For Unicon, apply Scout Hotfix 2609.1, 2508 CU2 LTSR, or Scout Cloud Gateway 1 2605.1-3 (securityonline.info).
  • Patch management-plane hosts first, restrict management network access to trusted systems, audit guest VM administrator rights, and review PXE boot segments and secure boot configurations (gbhackers.com).

Relatos divergentes

  • Severity of CVE-2026-98432: securityonline.info gives a CVSS of 9.8, while gbhackers.com says no CVSS score was disclosed. gbhackers.com also says HKCERT rated the bulletin only Medium (denial of service and security restriction bypass), against Citrix's Critical rating. The CVSS 9.8 figure is not corroborated by the other source.
  • Root cause: securityonline.info describes an IPv4 race condition. gbhackers.com says no root cause was disclosed.
  • Bulletin date: securityonline.info says November 4, 2026. gbhackers.com says November 3, 2026.
  • CVE count: gbhackers.com says nine CVEs are patched but names only eight (CVE-2026-98432, CVE-2026-102703 and six PXE/secure boot CVEs). The ninth is not identified in the sources.
  • A Help Net Security Patch Tuesday forecast (helpnetsecurity.com) was also published in this period but contains no Citrix-related information.

Linha do tempo

  1. helpnetsecurity.com ↗ · pub. 06/11/2026 04:00 · coletado 06/11 06:00

    November 2026 Patch Tuesday forecast: Old software continues to bite - Help Net Security

    ler a análise desta fonte

    How did you enjoy October 2026 Patch Tuesday? Were there enough CVEs reported to keep you busy for the rest of the year or are you finished and ready for another round next week? They released the regularly scheduled update nearly two and a half hours late, but Microsoft did resolve another record-breaking 1,407 unique CVEs.

    As in previous months, there were limited CVEs we needed to immediately deal with. In October, one zero-day CVE-2026-96951 was confirmed exploited; it was a Windows Shell security feature bypass impacting Windows 10, Windows 11 and Windows Server. And CVE-2026-10839 was publicly disclosed; it was a .NET Framework security bypass vulnerability. Overall, there were 78 Critical vulnerabilities, which was a small fraction of all CVEs reported.

  2. gbhackers.com ↗ · pub. 05/11/2026 05:46 · coletado 05/11 06:00

    Citrix Patches Critical XenServer Flaws Allowing Unauthenticated Host Takeover

    ler a análise desta fonte

    Citrix (Cloud Software Group) released bulletin CTX697256 on November 3, 2026, patching nine CVEs affecting XenServer 8.4 and 9, rated Critical by Citrix. The most severe, CVE-2026-98432, may allow an unauthenticated attacker on the management network to compromise the virtualization host as well as any running Workload Balancing (WLB) or Conversion Manager appliances; no CVSS score or root cause was disclosed, and Citrix has not confirmed any relation to the identically numbered Linux kernel IPv4 use-after-free bug. A second flaw, CVE-2026-102703, could let a privileged guest VM user break isolation and compromise the host, posing particular risk in multi-tenant hosting environments. Six additional CVEs affect PXE network booting and secure boot, potentially allowing network attackers to compromise PXE-booting VMs or guest admins to bypass secure boot. Notably, HKCERT rated the bulletin only Medium risk citing denial of service and security restriction bypass, conflicting with Citrix's Critical classification; no active exploitation has been reported.

    Technical Details

    All nine CVEs affect XenServer 8.4 and XenServer 9; CVE-2026-98432 additionally affects Workload Balancing before 2026.1.1 and Conversion Manager before 2026.2.0. The PXE/secure-boot group comprises CVE-2026-97631, CVE-2026-45447, CVE-2024-38797, CVE-2024-38796, CVE-2022-36764, CVE-2022-36763. A separate Critical bulletin, CTX697300, addresses CVE-2026-111497, a Google Brotli unchecked return value flaw affecting Unicon eLux Scout.

    Remediation

    Citrix has pushed fixes to Early Access and Normal update channels for both XenServer versions and recommends updating to the latest release, plus upgrading Workload Balancing to 2026.1.1+ and Conversion Manager to 2026.2.0+. Administrators should patch management-plane hosts first, restrict management network access to trusted systems, audit guest VM administrator rights, and review PXE boot segments and secure boot configurations.

  3. securityonline.info ↗ · pub. 04/11/2026 21:06 · coletado 04/11 23:00 primeiro registro

    Citrix Patches Critical XenServer Flaws (CVSS 9.8) Enabling Host Takeover and Guest Escape; Unicon Scout Brotli Bug Also Fixed

    ler a análise desta fonte

    Cloud Software Group issued security bulletins on November 4, 2026, fixing multiple critical vulnerabilities in XenServer and Unicon eLux Scout thin-client management tools. The most severe flaw, CVE-2026-98432 (CVSS 9.8), is an IPv4 race condition that lets an unauthenticated attacker on the management network compromise the hypervisor host and any running Workload Balancing (WLB) or Conversion Manager appliances. A second flaw, CVE-2026-102703, allows a privileged guest VM user to break out and compromise the host. A cluster of pre-boot PXE firmware bugs, including CVE-2026-97631, enables remote code execution or secure boot bypass during VM network boot, alongside an OpenSSL flaw (CVE-2026-45447) and older EDK2 issues. Separately, the Unicon eLux Scout advisory patches CVE-2026-111497, a critical buffer overflow in Google's Brotli decoder affecting UniconOS Management (Scout) On-Prem and Scout Cloud Gateway. Citrix states it has seen no active exploitation of the XenServer flaws and no public exploit code exists, though it notes the Brotli flaw has been actively exploited elsewhere on the web.

    Technical Details

    • CVE-2026-98432: race condition in IPv4 connection handling frees socket options prematurely, causing memory corruption that enables host takeover.
    • CVE-2026-102703: guest VM isolation breakout allowing a privileged guest user to compromise the host.
    • CVE-2026-97631 and related PXE/firmware bugs allow pre-boot RCE or secure boot bypass over IPv4/IPv6 during VM network boot.
    • CVE-2026-111497 in Unicon eLux Scout stems from an unchecked return value in the Brotli decoder, allowing memory corruption or code execution via a crafted compressed stream.
    • Affected: XenServer 8.4 and XenServer 9; Workload Balancing before 2026.1.1; Conversion Manager before 2026.2.0; UniconOS Management (Scout) On-Prem and Scout Cloud Gateway.

    Remediation

    • Update XenServer hosts via the Early Access or Normal update channels.
    • Update Workload Balancing to 2026.1.1 or later and Conversion Manager to 2026.2.0.
    • Apply Scout Hotfix 2609.1, 2508 CU2 LTSR, or Scout Cloud Gateway 1 2605.1-3.