Citrix has released security updates for XenServer 8.4 and XenServer 9. The updates fix several vulnerabilities, three of which could let a malicious privileged guest VM user compromise or crash the underlying host. Cloud Software Group rated the bulletin High severity.
According to the advisory published by Citrix on October 13, 2026 as CTX697170, the update covers four CVE identifiers.
| CVE ID | Impact | Attacker Privilege | Affected Versions |
| CVE-2026-79610 | Host compromise or crash | Privileged guest user | XenServer 8.4, 9 |
| CVE-2026-102700 | Host compromise or crash | Privileged guest user | XenServer 8.4 only |
| CVE-2026-102701 | Host compromise or crash | Privileged guest user | XenServer 8.4, 9 |
| CVE-2026-79611 | Guest VM crash | Unprivileged guest user | XenServer 8.4, 9 |
XenServer is a hypervisor, so the host runs many guest VMs on shared hardware. A flaw that lets a guest affect the host breaks the isolation boundary that virtualized environments depend on.
Three of the four issues fall into this category. In each case, a malicious user with administrative rights inside a guest VM could compromise the host or crash it.
A successful host compromise could expose other tenants’ workloads on the same server. A host crash could take every VM on that server offline. The risk is greatest in multi-tenant deployments, hosting providers and shared lab environments, where guest administrators may not be fully trusted.
The fourth flaw, CVE-2026-79611, is narrower. An unprivileged guest user could crash only their own guest VM, so the host isn’t affected. It still deserves patching because it can disrupt availability.
Both XenServer 8.4 and XenServer 9 are affected. The exception is CVE-2026-102700, which affects XenServer 8.4 only. The bulletin gives no technical root causes, CVSS scores, proof-of-concept details or reports of active exploitation.
Citrix also says the issues “may or may not impact” a given system, so administrators should check their own deployments.
Citrix has pushed fixes to the Early Access and Normal update channels for both XenServer 8.4 and XenServer 9. The bulletin doesn’t list workarounds, so patching is the recommended remedy.
Administrators should update to the latest version from their chosen channel, following the XenServer 8 update guide or the XenServer 9 update guide, prioritize hosts that run untrusted or third-party guest workloads, audit who holds administrator rights inside guest VMs, subscribe to Citrix security alerts for bulletin updates, and contact Citrix Technical Support if they need help.
Hypervisor vulnerabilities attract attention from attackers because one flaw can affect many workloads. No exploitation has been reported for these CVEs.
Even so, virtualization administrators should patch promptly and watch for further technical details from Citrix or independent researchers.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…