Citrix Patches XenServer Host Escape Risks and UniconOS Privilege Escalation Flaws
Do Son 
TL;DR
Citrix released two high-severity bulletins covering seven flaws in XenServer and UniconOS. This Citrix security update matters most for XenServer, where three bugs could let a privileged guest compromise or crash the host. UniconOS also gets fixes, including a CVSS 8.5 local privilege escalation flaw.
- Total: 6 CVEs
- Severity: 1 High · 2 Medium · 3 Unrated
- Actively exploited: None confirmed
- Highest severity: 8.5 (High · CVSSv4) — CVE-2026-53562
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv4) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-53562 | 8.5 | Local Privilege Escalation | 2607 CR, 2603 LTSR CU2 | Not exploited |
| CVE-2026-53563 | 6.9 | Persistent Command Execution | 2607.2 CR, 2603 LTSR CU2 | Not exploited |
| CVE-2026-53564 | 5.1 | Arbitrary file read and write | 2607.2 CR, 2603 LTSR CU2 | Not exploited |
| CVE-2026-79610 | Awaiting analysis | grant-table: double version change race | — | Not exploited |
| CVE-2026-102700 | Awaiting analysis | gnttab: cache-flush handling may cause page reference leak | — | Not exploited |
| CVE-2026-79611 | Awaiting analysis | VMX: VMentry failure with branch tracing and blocked states | — | Not exploited |
Why It Matters
XenServer hosts many virtual machines on one server. A guest-to-host escape breaks that isolation and exposes every other VM on the machine. Meanwhile, UniconOS (formerly eLux) runs on thin clients that connect users to virtual desktops.
How the Attacks Work
XenServer: guest-to-host flaws
Citrix warns that three issues “may allow a malicious privileged user in a guest VM to compromise or crash the host.” The upstream Xen Project advisories add detail:
- CVE-2026-79610 (XSA-517): a race in grant-table version changes. Xen says a guest “may be able to escalate its privileges to those of the host.”
- CVE-2026-102701 (XSA-521): a stack overflow in tapdisk, which normally runs as root, “potentially leading to code execution.”
- CVE-2026-102700 (XSA-520): a page reference leak that most likely causes denial of service.
- CVE-2026-79611 (XSA-518): a state-handling bug that lets an unprivileged user crash their own guest VM.
UniconOS: local and wireless flaws
- CVE-2026-53562 (CVSS 8.5): a link-following bug lets a low-privileged local user escalate privileges.
- CVE-2026-53563 (CVSS 6.8): weak permissions allow persistent command execution.
- CVE-2026-53564 (CVSS 5.1): an attacker running a rogue Wi-Fi access point can read and write files when a user opens a captive portal.
Who is most at risk
Hosting providers and companies that run untrusted VMs side by side face the greatest XenServer risk. A single compromised guest could reach the host and its neighbors. For UniconOS, shared thin clients in offices, clinics and schools are the likely targets of the local privilege escalation bugs. Both groups should treat this Citrix security update as a priority.
Exploitation status
Neither Citrix nor the Xen Project reports exploitation in the wild. No public proof-of-concept has been confirmed either.
Affected Versions
- XenServer: 8.4 and 9. CVE-2026-102700 affects only XenServer 8.4.
- UniconOS: Current Release before 2607.2, and LTSR before 2603 LTSR CU2.
Patch and Mitigation Steps
- Apply the hotfixes listed in the XenServer security bulletin CTX697170.
- Upgrade UniconOS to 2607.2 or 2603 LTSR CU2, as detailed in the UniconOS security bulletin CTX697187.
- Until XenServer hosts are patched, consider the Xen mitigation for CVE-2026-79610: restrict guests to grant table version 1.
Citrix “strongly recommends that customers upgrade” as soon as possible. Admins running shared hosts should apply this Citrix security update first.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
