Critical Citrix XenServer Flaw Enables Unauthenticated Host Compromise

Citrix disclosed CVE-2026-98432, a critical XenServer vulnerability that could let an unauthenticated attacker with access to the management network compromise virtualization hosts or supporting appliances. The bulletin covers XenServer 8.4 and XenServer 9, along with affected Workload Balancing and Conversion Manager appliances. It also describes CVE-2026-102703, which could allow a privileged guest user to compromise the host, and six additional vulnerabilities involving network booting or Secure Boot.

Citrix released XenServer fixes through its Normal and Early Access channels and advised updating Workload Balancing to 2026.1.1 or later and installing Conversion Manager 2026.2.0. Administrators should prioritize affected systems and verify management-network isolation: exposure to the critical flaw depends on management-network reachability, not unrestricted internet access. The bulletin does not confirm active exploitation or identify an associated malware campaign.