Critical Citrix XenServer Flaw Allows Unauthenticated Attackers to Take Control of Virtualization Hosts

Citrix has released security updates for XenServer versions 8.4 and 9 to address a critical vulnerability. This flaw could allow an unauthenticated attacker on the management network to compromise virtualization hosts.

The Cloud Software Group published a bulletin (CTX697256) on November 3, 2026, classifying the issue as Critical. The bulletin covers nine CVEs.

Citrix XenServer Flaw

The most severe issue identified is CVE-2026-98432. According to Citrix, this vulnerability may enable an unauthenticated attacker on the management network to compromise the host.

Additionally, the same attacker could also compromise any running Workload Balancing (WLB) or Conversion Manager appliances. The bulletin does not provide a CVSS score or technical root cause for this vulnerability.

Notably, CVE-2026-98432 shares the same identifier as a Linux kernel IPv4 TCP use-after-free vulnerability, which has a CVSS score of 9.8. Reports suggest that this vulnerability could be exploited remotely to gain root access.

However, Citrix has not indicated whether the two vulnerabilities are related, so administrators should not assume a connection. The bulletin also does not mention any active exploitation attempts.

A second flaw, CVE-2026-102703, may let a privileged user inside a guest VM compromise the host. That breaks the isolation that virtualization depends on. The risk is highest in multi-tenant and hosting environments, where guest administrators may not be fully trusted.

A third group of six CVEs affects network booting and secure boot. These are CVE-2026-97631, CVE-2026-45447, CVE-2024-38797, CVE-2024-38796, CVE-2022-36764 and CVE-2022-36763. They may let an unauthenticated attacker on the same network compromise a PXE-booting VM during its initial boot stage. They may also let a guest VM administrator bypass the guest’s secure boot policy.

All of the issues affect both XenServer 8.4 and XenServer 9. CVE-2026-98432 also affects Workload Balancing before version 2026.1.1 and Conversion Manager before version 2026.2.0. HKCERT rated the bulletin Medium risk and listed denial of service and security restriction bypass as the impacts. That differs from Citrix’s Critical rating.

Citrix has pushed fixes to the Early Access and Normal update channels for both XenServer versions. It recommends updating to the latest version from your chosen channel. It also recommends Workload Balancing 2026.1.1 or later and Conversion Manager 2026.2.0. The appliance updates are available from the XenServer downloads page.

Administrators should take these steps:

• Patch management-plane hosts first.
• Restrict management network access to trusted administrative systems.
• Audit who holds administrator rights inside guest VMs.
• Review PXE boot segments and secure boot configurations.

Citrix also lists a separate Critical bulletin, CTX697300. It covers CVE-2026-111497, a Google Brotli unchecked return value flaw that affects Unicon eLux Scout.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.