XenServer Security Update for Multiple Issues

Severity: Critical Description of Problem An issue has been identified that may allow an unauthenticated attacker on the management network to compromise the hostand/or any running Workload Balancing WLB or Conversion Manager appliances. This issue has the following identifier: CVE-2026-98432 A...

PT-2026-136760

Name of the Vulnerable Software and Affected Versions Xen versions 4.6 and later Description A hypervisor escape allows a malicious guest virtual machine to read and write memory belonging to other virtual machines, including the privileged domain dom0. This issue affects Citrix XenServer and all...

XenServer Security Update for CVE-2026-114406

Severity: High Description of Problem XenServer's internal list of trusted certificate authorities CAsincluded apublic CA whose intermediate certificateshave been found to haveweak keys. This would allow a malicious attacker on the management network to forge TLScertificatesthat appeared to be...

Citrix XenServer 8.4.x / 9.x Multiple Vulnerabilities (CTX697170)

The version of Citrix XenServer installed on the remote host is 8.4.x or 9.x. It is, therefore, affected by multiple vulnerabilities as referenced in the CTX697170 advisory: - A grant table race on a v2 - v1 - v2 version change may allow a privileged user in a guest VM to compromise or crash the...

Citrix XenServer 8.4.x Page Reference Leak (CTX697170)

The version of Citrix XenServer installed on the remote host is 8.4.x. It is, therefore, affected by a vulnerability as referenced in the CTX697170 advisory: - The grant table cache-flush error path fails to drop a page reference, which may allow a privileged user in a guest VM to compromise or...

PT-2026-115091

New Citrix XenServer flaws in versions 8.4 & 9 threaten host systems if VMs have elevated rights. Watch out for CVE-2026-79610, CVE-2026-102700, CVE-2026-102701 & -79611. The bulletin reveals host-impacting vulnerabilities, guest crash risks, and no full exploit code yet. Confirm your XenServer...

XenServer Security Update for CVE-2026-79610, CVE-2026-79610, CVE-2026-102700 and CVE-2026-102701

Severity : High Description of Problem Several issues have been identified that affect XenServer 8.4 and XenServer 9. Three of these issues may allow a malicious privileged user in a guest VM to compromise or crash the host. These issues have the following identifiers: CVE-2026-79610...

Build Numbers and Versions of Veeam Plug-In for Xen

This KB article lists all versions of the Veeam Plug-In for Xen and their respective worker build numbers. Version| Plug-In / Worker Build| Release Date ---|---|--- Veeam Plug-In for Xen 1 Releases Veeam Plug-In for Xen 1.1 Included with Veeam Backup & Replication 13.1.2| 13.1.1.7| 2026-10-27 Vee...

XenServer Security Update for Multiple Issues

Severity :High Description of Problem Several issueshave beenidentifiedthat affect XenServer 8.4 and XenServer 9. Collectively, these issues may allowa malicious privileged userin a guest VM to compromise or crash the host. Theseissueshavethe following identifiers: CVE-2026-42492XenServer 9 only...

XenServer Security Update for CVE-2026-42491

Severity: Medium Description of Problem An issue has been identified in the XenServer management API SDK that may allow an attacker on the management network who is able to intercept specific HTTPS requests within a higher-level operation to be able to act with the privileges of the intercepted...

PT-2026-58855

Name of the Vulnerable Software and Affected Versions Citrix XenServer SDK versions prior to 26.15.0 XenCenter versions prior to 2026.4.0 Description Some SDKs lack proper TLS verification during network communication with a host running XAPI. This flaw allows an attacker to perform a...

CVE-2026-23560

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. XAPI can configure different users with different roles, using Role Based Access Control. For more details, see:...

XCP-ng RBAC Storage Driver Privilege Escalation

The vulnerability of the storagedriverdomain driver in the Role-Based Access Control RBAC subsystem of the XCP-ng hypervisor and the XenServer server virtualization platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to elevate their...

XCP-ng RBAC Privilege Escalation

The vulnerability of function systemdomains.ml:30-35 in the RBAC access control subsystem of the XCP-ng hypervisor and the XenServer server virtualization platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to elevate their privileges...

XCP-ng Supervisor RBAC Access Bypass

The vulnerability of the setotherconfig function in the RBAC access control subsystem of the XCP-ng supervisor and the XenServer server virtualization platform is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain...

XCP-ng RBAC HVM Serial Write Access

The vulnerability of the hvmserial component in the Role-Based Access Control RBAC access management subsystem of the XCP-ng hypervisor and the XenServer server virtualization platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor,...

CVE-2026-23556

creationtimestamp| type| source ---|---|--- 2026-04-29 01:49:24+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-citrix-xenserver 2026-04-29 12:45:35+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkn4wpcktx2h 2026-04-29 12:50:07+00:00| seen|...

XenServer Security Update for Multiple Issues

Severity: High Description of Problem Several issues have been identified that affect XenServer 8.4. These are: An issue that may, in some circumstances, allow a malicious privileged user in a guest VM to compromise the host. This issue has the following identifier: CVE-2026-23558 An issue that m...

PT-2026-42284

Уязвимость функции map keys roles подсистемы ролевого управления доступом RBAC гипервизора XCP-ng и платформы для серверной виртуализации XenServer связана с отсутствием авторизации. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, обойти существующие механизмы безопасно...

PT-2026-42283

Уязвимость драйвера storage driver domain подсистемы ролевого управления доступом RBAC гипервизора XCP-ng и платформы для серверной виртуализации XenServer связана с недостатками разграничения доступа. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, повысить свои...