Critical Citrix XenServer Vulnerability Could Let Hackers Take Over Virtualization Hosts Without Authentication

What happened?

Citrix has disclosed a critical XenServer vulnerability that could let an unauthenticated attacker compromise virtualization hosts and supporting appliances. Tracked as CVE-2026-98432, the flaw requires access to the management network, an important limit when assessing which systems are exposed. The November 3 security bulletin covers XenServer 8.4 and XenServer 9, alongside affected Workload Balancing and Conversion Manager appliances. Unlike previously reported Citrix XenServer guest vulnerabilities, the headline issue does not require a privileged account inside a virtual machine.

Key details

• The flaw allows unauthenticated attackers to compromise virtualization hosts and appliances.
• Exploitation requires access to the management network, limiting exposure scope.
• Affected products include XenServer 8.4, XenServer 9, Workload Balancing, and Conversion Manager appliances.
• A separate flaw CVE-2026-102703 allows privileged guest users to compromise the host.
• Six additional vulnerabilities affect network booting and Secure Boot mechanisms.
• Citrix released fixes through Normal and Early Access channels for both XenServer releases.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.