By Divya
Publication Date: 2026-11-05 08:46:00
Citrix has released security updates for XenServer versions 8.4 and 9 to address a critical vulnerability. This flaw could allow an unauthenticated attacker on the management network to compromise virtualization hosts.
The Cloud Software Group published a bulletin (CTX697256) on November 3, 2026, classifying the issue as Critical. The bulletin covers nine CVEs.
Citrix XenServer Flaw
The most severe issue identified is CVE-2026-98432. According to Citrix, this vulnerability may enable an unauthenticated attacker on the management network to compromise the host.
Additionally, the same attacker could also compromise any running Workload Balancing (WLB) or Conversion Manager appliances. The bulletin does not provide a CVSS score or technical root cause for this vulnerability.
Notably, CVE-2026-98432 shares the same identifier as a Linux kernel IPv4 TCP use-after-free vulnerability, which has a CVSS score of 9.8. Reports suggest that this vulnerability could be exploited remotely to gain root access.
However, Citrix has not indicated whether the two vulnerabilities are related, so administrators should not assume a connection. The bulletin also does not mention any active exploitation attempts.
A second flaw, CVE-2026-102703, may let a privileged user inside a guest VM compromise the host. That breaks the isolation that virtualization depends on. The risk is highest in multi-tenant and hosting environments, where guest administrators may not be fully…
