Citrix XenServer Vulnerability Could Allow Host Compromise
Original title: Critical Citrix XenServer Vulnerability Could Let Hackers Take Over Virtualization Hosts Without Authentication
CVE-2026-98432 in XenServer 8.4 and 9 requires management network access for unauthenticated host takeover.
Citrix disclosed a critical flaw in XenServer that lets unauthenticated attackers compromise hosts, Workload Balancing and Conversion Manager appliances. The issue needs management network reachability only. Fixes are available via Normal and Early Access channels. A separate CVE-2026-102703 targets privileged guest users.
- Affects XenServer 8.4 and 9
- No privileged account inside VM required
- Six additional vulnerabilities cover network booting and Secure Boot
- Fixes released for both releases
- Administrators should isolate management network
Impact: unauthenticated host compromise
- 1.Update to 2026.1.1 or later
- 2.Install Conversion Manager 2026.2.0
- 3.Isolate management network
- Vendors
- Citrix
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102703 | Frame/grant ref mixing in Xen grant copy cache | 4.4 | — | ||
| CVE-2026-98432 | Use-after-free in Linux kernel IPv4 TCP options | 9.8 | <1% | PoC ×25 |
From the original article
2 min read at cybersecuritynews.com
Citrix has disclosed a critical XenServer vulnerability that could let an unauthenticated attacker compromise virtualization hosts and supporting appliances. Tracked as CVE-2026-98432, the flaw requires access to the management network, an important limit when assessing which systems are exposed. The November 3 security bulletin covers XenServer 8.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.