Citrix warns of critical unauthenticated flaw that can take over XenServer virtualization hosts
Citrix bulletin CTX697256 fixes a critical flaw, CVE-2026-98432, that lets an unauthenticated attacker on the management network compromise XenServer 8.4 and.
- Published
- Updated
- Ecosystem
- Enterprise softwareCloud
- Fixed in
- Patches released in CTX697256. XenServer 8.4 and 9: install the latest version from your Early Access or Normal update channel (no build numbers published). Workload Balancing: 2026.1.1 or later. Conversion Manager: 2026.2.0
- Exploitation
- No. Neither outlet reports active exploitation, and the bulletin does not mention exploitation attempts
What happened
- 3 November 2026: Cloud Software Group published XenServer security bulletin CTX697256, rated Critical, covering multiple issues in XenServer 8.4 and XenServer 9 (GBHackers; Cyber Security News).
- CVE-2026-98432 is the most severe issue. GBHackers reports it “may enable an unauthenticated attacker on the management network to compromise the host,” and that the same attacker could also compromise running Workload Balancing (WLB) or Conversion Manager appliances (GBHackers; Cyber Security News).
- CVE-2026-102703 requires a privileged user inside a guest VM, who may then compromise the host, breaking virtualization isolation. GBHackers notes the risk is highest in multi-tenant and hosting environments (GBHackers; Cyber Security News).
- A further group of issues affects network booting (PXE) and Secure Boot: an unauthenticated attacker on the same network may compromise a PXE-booting VM during initial boot, and a guest VM administrator may bypass the guest’s Secure Boot policy (Cyber Security News; GBHackers). GBHackers names these as CVE-2026-97631, CVE-2026-45447, CVE-2024-38797, CVE-2024-38796, CVE-2022-36764 and CVE-2022-36763 (GBHackers).
- Neither outlet reports active exploitation. Cyber Security News says the disclosure concerns software vulnerabilities, “not an identified malware campaign,” and lists no indicators of compromise; GBHackers says the bulletin does not mention exploitation attempts (Cyber Security News; GBHackers).
Where the two outlets differ. Neither source publishes a CVSS score or root-cause detail for any of the Citrix CVEs (Cyber Security News; GBHackers). GBHackers adds that the identifier CVE-2026-98432 is also shared with a Linux kernel IPv4 TCP use-after-free flaw carrying CVSS 9.8, but stresses Citrix has not said the two are related, so that score should not be read as the XenServer rating (GBHackers). GBHackers also notes HKCERT rated the bulletin Medium, citing denial of service and security-restriction bypass as impacts, against Citrix’s own Critical rating (GBHackers). On the CVE count the sources diverge: GBHackers states the bulletin “covers nine CVEs” but names only eight, while Cyber Security News describes two named CVEs plus six additional PXE/Secure Boot issues it says the bulletin did not individually ID (GBHackers; Cyber Security News). Treat all affected products as vulnerable until the relevant update is confirmed installed.
Affected versions
Both outlets report the affected products below; neither publishes XenServer build numbers (Cyber Security News; GBHackers).
| Product | Affected | Fixed version |
|---|---|---|
| XenServer 8.4 | Yes (all issues) | Latest version from the Early Access or Normal update channel |
| XenServer 9 | Yes (all issues) | Latest version from the Early Access or Normal update channel |
| Workload Balancing appliance | Versions before 2026.1.1 (CVE-2026-98432) | 2026.1.1 or later |
| Conversion Manager appliance | Versions before 2026.2.0 (CVE-2026-98432) | 2026.2.0 |
Citrix recommends installing “the latest version from your chosen channel” for XenServer rather than a specific build; appliance updates are on the XenServer downloads page (GBHackers; Cyber Security News).
What to do
- Update XenServer 8.4 and XenServer 9 to the latest version in your Early Access or Normal update channel (GBHackers).
- Update the appliances: Workload Balancing to 2026.1.1 or later, and Conversion Manager to 2026.2.0, from the XenServer downloads page (Cyber Security News; GBHackers).
- Isolate the XenServer management network from untrusted systems, since CVE-2026-98432 requires an attacker to reach that network (Cyber Security News; GBHackers).
- Tighten guest trust in multi-tenant and hosting environments, where a privileged guest user exploiting CVE-2026-102703 could break host isolation (GBHackers).
- Control network access for PXE-booting VMs and review Secure Boot policy, as the network-boot issues allow a network-adjacent attacker or a guest administrator to interfere with boot integrity (Cyber Security News; GBHackers).
- Consult the official Citrix bulletin CTX697256 for the authoritative CVE list and update guidance (GBHackers).
Sources
- Cyber Security News: Critical Citrix XenServer Vulnerability Could Let Hackers Take Over Virtualization Hosts Without Authentication (5 November 2026)
- GBHackers: Critical Citrix XenServer Flaw Allows Unauthenticated Attackers to Take Control of Virtualization Hosts (5 November 2026)
- Citrix / Cloud Software Group bulletin CTX697256: XenServer Security Update for Multiple Issues (3 November 2026), primary source referenced by both outlets; not independently retrievable (JavaScript-rendered)