By Kavichselvan
Publication Date: 2026-10-15 10:23:00
Citrix has released security updates for XenServer 8.4 and XenServer 9. The updates fix several vulnerabilities, three of which could let a malicious privileged guest VM user compromise or crash the underlying host. Cloud Software Group rated the bulletin High severity.
Citrix XenServer vulnerabilities
According to the advisory published by Citrix on October 13, 2026 as CTX697170, the update covers four CVE identifiers.
| CVE ID | Impact | Attacker Privilege | Affected Versions |
| CVE-2026-79610 | Host compromise or crash | Privileged guest user | XenServer 8.4, 9 |
| CVE-2026-102700 | Host compromise or crash | Privileged guest user | XenServer 8.4 only |
| CVE-2026-102701 | Host compromise or crash | Privileged guest user | XenServer 8.4, 9 |
| CVE-2026-79611 | Guest VM crash | Unprivileged guest user | XenServer 8.4, 9 |
XenServer is a hypervisor, so the host runs many guest VMs on shared hardware. A flaw that lets a guest affect the host breaks the isolation boundary that virtualized environments depend on.
Three of the four…