Citrix Patches XenServer Vulnerabilities That Could Enable Host Compromise
Citrix patched four XenServer flaws, three of which could let a privileged guest compromise or crash the host.
Citrix bulletin CTX697170, published October 13, 2026, patches four vulnerabilities in XenServer 8.4 and 9 and rates the issue High. CVE-2026-79610, CVE-2026-102701, and CVE-2026-102700 could allow a privileged guest administrator to compromise or crash the host; CVE-2026-102700 affects only XenServer 8.4. CVE-2026-79611 lets an unprivileged guest user crash that guest VM only. Citrix provides no root-cause details, CVSS scores, or proof of concept, reports no active exploitation, and recommends updates from the Early Access or Normal channels.
- Bulletin CTX697170 covers XenServer 8.4 and XenServer 9.
- Three flaws could let a privileged guest compromise or crash the host.
- CVE-2026-102700 affects XenServer 8.4 only.
- CVE-2026-79611 can crash only the attacker’s own guest VM.
- Citrix reports no active exploitation and lists no workarounds.
- Vendors
- Citrix
- Products
- XenServer
- Organizations
- CitrixCloud Software Group
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-79610+2 related CVEs | Stale grant-table pointers in Xen may enable host compromise | 8.8 group max | — | ||
| CVE-2026-102701 | — | — | — |
From the original article
2 min read at gbhackers.com
Citrix has released security updates for XenServer 8. 4 and XenServer 9. The updates fix several vulnerabilities, three of which could let a malicious privileged guest VM user compromise or crash the underlying host.
By Kavichselvan · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.