Citrix XenServer Vulnerabilities Could Allow Malicious VM Users to Compromise Host Systems
Citrix disclosed four XenServer flaws that may let privileged guest users compromise or crash the host.
Citrix bulletin CTX697170, published October 13, 2026, discloses four vulnerabilities in XenServer 8.4 and XenServer 9. CVE-2026-79610, CVE-2026-102700, and CVE-2026-102701 may allow a privileged user inside a guest VM to compromise or crash the host; CVE-2026-102700 affects only version 8.4. CVE-2026-79611 may let an unprivileged guest user crash that same guest. The advisory gives no fixed-build names and does not report active exploitation.
- CTX697170 covers XenServer 8.4 and XenServer 9.
- Three flaws may let a privileged guest user compromise or crash the host.
- CVE-2026-102700 affects XenServer 8.4 only.
- CVE-2026-79611 can crash only the attacker’s own guest.
- No fixed builds or active exploitation were reported.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-79610+2 related CVEs | Stale grant-table pointers in Xen may enable host compromise | 8.8 group max | — | ||
| CVE-2026-102701 | — | — | — |
From the original article
2 min read at cybersecuritynews.com
Citrix has disclosed four XenServer vulnerabilities, including three that could let a malicious user with elevated rights inside a virtual machine compromise or crash the underlying host. Citrix published the high-severity bulletin CTX697170 on October 13, 2026, covering XenServer 8. 4 and XenServer 9.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.