Citrix has patched six security flaws in XenServer, including a serious vulnerability that could let an unauthenticated attacker work out the secret used to authenticate hosts in a virtualisation pool and take full control of it. The flaw is tracked as CVE-2026-102705, also known as XSA-529, and was disclosed on 10 November 2026.

The problem sits in XAPI, the management component of XenServer and XCP-ng. Hosts in a pool authenticate requests to each other using a bearer token known as the Pool Secret. The comparison of that token was carried out with a function whose timing depends on the data being compared. That gives an attacker a timing oracle: by measuring how long each guess takes, they can gradually infer the value of the Pool Secret without any credentials at all.

Once the secret is known, an unauthenticated attacker can gain full access to the pool. Vates, the company behind XCP-ng, rates the impact as critical, the highest level in its severity scale. SecurityWeek describes the flaw as high severity. No CVSS score had been published when the advisory went out.

Five more XenServer flaws and AMD chip fixes

The same XenServer update fixes five further issues. According to SecurityWeek, the remaining flaws could lead to privilege escalation or allow administrators holding any role to terminate the running tasks of other roles. Citrix also released XenServer updates that mitigate several AMD processor vulnerabilities that could allow a guest virtual machine to compromise the host or infer the active memory contents of another virtual machine.

For XCP-ng, the open-source platform built on the same code, version 8.3 is affected. Vates has released a fixed xapi package, version 26.1.21-1.4.xcpng8.3, and says there is no mitigation other than patching. A restart of the toolstack is needed for the fix to take effect.

Administrators are also strongly encouraged to regenerate the Pool Secret after deploying the fixed XAPI to every member of the pool, using the command xe pool-secret-rotate. That step runs live and does not need a toolstack restart, but it will fail if high availability is enabled or if tasks are running on the pool.

What administrators should do now

Organisations running XenServer should install the latest updates from their normal update channel, and XCP-ng 8.3 users should apply the fixed xapi package. After patching, rotating the Pool Secret is the key follow-up step, because a secret inferred before the patch would still be valid afterwards.

Management interfaces for virtualisation platforms should not be reachable from the internet in the first place, and this flaw is a reminder of why. The Pool Secret protects the trust between hosts in a pool, so anyone able to reach the management network and exploit the timing flaw could move from no access at all to full control of the virtual machines running on it.

The advisories do not report any exploitation of CVE-2026-102705 in the wild. Even so, the combination of unauthenticated access and full pool takeover makes this one of the more urgent virtualisation patches of the month, and administrators should treat the patch and the secret rotation as a single job rather than two separate tasks.