Citrix has released a critical security update for XenServer after disclosing a flaw that could let an attacker without any login take over a virtualisation host. The update, published on 3 November 2026 as bulletin CTX697256, covers nine vulnerabilities across XenServer 8.4 and XenServer 9.

XenServer runs the virtual machines behind many business systems, so a flaw in the host itself matters more than a flaw in a single guest. Whoever controls the host can reach every virtual machine running on it, which is why Citrix rated this bulletin Critical and why administrators are being urged to patch management-plane systems first.

The most serious issue is tracked as CVE-2026-98432. According to Citrix, an unauthenticated attacker with access to the management network may be able to compromise the host, and the same attacker could also compromise any running Workload Balancing or Conversion Manager appliances. Citrix has not published a CVSS score or a technical root cause for the flaw in its bulletin.

Guest escape and boot flaws in the same update

A second vulnerability, CVE-2026-102703, could allow a privileged user inside a guest virtual machine to compromise the host underneath it. That breaks the isolation virtualisation depends on, and the risk is highest in multi-tenant and hosting environments, where the administrators inside guest machines may not be fully trusted.

Six further vulnerabilities affect network booting and secure boot: CVE-2026-97631, CVE-2026-45447, CVE-2024-38797, CVE-2024-38796, CVE-2022-36764 and CVE-2022-36763. They may let an unauthenticated attacker on the same network compromise a virtual machine that boots over the network, or let a guest administrator bypass the guest's secure boot policy.

What administrators should do

Citrix has pushed fixes to the Early Access and Normal update channels for both XenServer 8.4 and XenServer 9, and recommends updating to the latest release from the chosen channel. Workload Balancing should be updated to version 2026.1.1 or later, and Conversion Manager to 2026.2.0 or later.

Administrators should patch management-plane hosts first, restrict management network access to trusted administrative systems, audit who holds administrator rights inside guest virtual machines, and review PXE boot segments and secure boot settings. Keeping the management network separate from ordinary office and guest traffic limits who can even reach the vulnerable services.

Do not confuse this CVE with the Linux kernel flaw

CVE-2026-98432 shares its identifier with a Linux kernel IPv4 TCP vulnerability that carries a CVSS score of 9.8. Citrix has not said the two vulnerabilities are related, so administrators should not assume a connection between them. Citrix has also not reported any active exploitation of the XenServer flaws.

Citrix published a separate critical bulletin, CTX697300, covering CVE-2026-111497, a flaw in the Google Brotli decoder affecting Unicon eLux Scout. That flaw is listed in CISA's Known Exploited Vulnerabilities catalogue, with a remediation deadline of 10 November 2026 for US federal agencies.

Read the GBHackers report on the XenServer update and the Brandefense ranking of the week's patches for more detail.