Citrix Patches UniconOS Privilege Escalation and Warns of XenServer Host Compromise

Citrix disclosed vulnerabilities affecting UniconOS and XenServer, prompting security advisories from the Canadian Centre for Cyber Security and Italy’s ACN. Three UniconOS flaws—CVE-2026-53562, CVE-2026-53563 and CVE-2026-53564—affect Current Release versions before 2607.2 and Long Term Service Release versions before 2603 LTSR CU2. UniconOS, formerly eLux, is an endpoint operating system used primarily in VDI/DaaS environments. At least one flaw is rated high severity and could allow a locally authenticated attacker with limited privileges to elevate privileges; organizations should update affected installations to the corrected releases.

Citrix’s XenServer bulletin CTX697170 identifies four vulnerabilities. CVE-2026-79610, CVE-2026-102700 and CVE-2026-102701 could allow a privileged guest virtual machine user to compromise or crash the underlying host, while CVE-2026-79611 could allow an unprivileged guest user to crash that guest. CVE-2026-102700 affects only XenServer 8.4; the other three affect both XenServer 8.4 and XenServer 9. The supplied reporting does not identify fixed XenServer builds or confirm active exploitation. Administrators should inventory affected endpoints and virtualization hosts, review the latest vendor remediation guidance, and apply the necessary updates as available.