Citrix XenServer Flaw Allows Unauthenticated Host Compromise
Original title: Critical Citrix XenServer Flaw Allows Unauthenticated Attackers to Take Control of Virtualization Hosts
Updates fix nine CVEs including unauthenticated remote takeover in XenServer 8.4 and 9; Citrix rates as Critical.
Citrix released updates for XenServer 8.4 and 9 addressing nine CVEs that could allow unauthenticated attackers on the management network to compromise hosts. The most severe CVE-2026-98432 may enable remote root access while CVE-2026-102703 lets guest VM administrators break isolation. Network booting and secure boot issues also affect PXE VMs and guest policies. Citrix recommends updating hosts and related appliances; no active exploitation attempts are mentioned.
Unconfirmed: Whether CVE-2026-98432 relates to Linux kernel IPv4 TCP use-after-free; Citrix does not confirm active exploitation
- Nine CVEs total across XenServer 8.4/9
- CVE-2026-98432 enables unauthenticated management network compromise
- CVE-2026-102703 breaks guest isolation for privileged users
- HKCERT rates bulletin Medium risk
- Fixes pushed to Early Access and Normal channels
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2022-36763+1 related CVE | EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a heap buffer overflow via a local network | 7.8 | <1% | ||
| CVE-2024-38796 | EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage() | 5.9 | <1% | ||
| CVE-2024-38797 | EDK2 contains a vulnerability in the HashPeImageByType() | 4.6 | <1% | ||
| CVE-2026-102703 | Frame/grant ref mixing in Xen grant copy cache | 4.4 | — | ||
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
| CVE-2026-45447 | Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification | 8.8 | 4% | ||
| CVE-2026-97631 | Remote buffer overflow in EDK2 BIOS | 9.5 | <1% | PoC ×3 | |
| CVE-2026-98432 | Use-after-free in Linux kernel IPv4 TCP options | 9.8 | <1% | PoC ×25 |
From the original article
2 min read at gbhackers.com
Citrix has released security updates for XenServer versions 8. 4 and 9 to address a critical vulnerability. This flaw could allow an unauthenticated attacker on the management network to compromise virtualization hosts.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.