Citrix XenServer Vulnerabilities Could Allow Malicious VM Users to Compromise Host Systems

Citrix has disclosed four XenServer vulnerabilities, including three that could let a malicious user with elevated rights inside a virtual machine compromise or crash the underlying host.

Citrix published the high-severity bulletin CTX697170 on October 13, 2026, covering XenServer 8.4 and XenServer 9. Citrix lists the advisory in its XenServer security bulletin archive.

The host-impacting flaws are tracked as CVE-2026-79610, CVE-2026-102700, and CVE-2026-102701. A fourth issue, CVE-2026-79611, has a narrower effect. According to the supplied bulletin, it may allow an unprivileged user inside a guest virtual machine to crash that same guest.

The three host-impacting vulnerabilities require a privileged user within a guest VM. This places the stated threat inside the virtual environment rather than describing an unauthenticated attack against an internet-facing service.

Citrix XenServer Vulnerabilities

The bulletin groups these flaws as issues that may enable host…