Do Son 
TL;DR
Cloud Software Group issued security bulletins on November 4, 2026. The notices fix critical Citrix security vulnerabilities in XenServer and thin client tools. These flaws allow host takeovers. They also permit guest escapes and pre-boot code execution. Therefore, system admins must install the newest updates right away. They need to protect their virtual setups from attack. They must keep their systems safe.
- Total: 9 CVEs
- Severity: 4 Critical · 2 High · 3 Medium
- Actively exploited: 1 (exploited in the wild)
- Exploit Intel (PatchThis): 1 of 9 confirmed
- Highest severity: 9.8 (Critical · CVSSv3) — CVE-2026-98432
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-98432 | 9.8 | ipv4: free inet_opt and ireq_opt after an RCU grace period | b3b027ef0cd322bfa839b9aaf5b27551eea54cf6, 95a8c8fa9f27dce64c40c41c062de7728bf34ab5, 89b5b1eb7d633c33832b7ff2c02e19a144705036 (+13) | Not exploited |
| CVE-2026-45447 | 9.8 | CWE-416 | 4.0.1, 3.6.3, 3.5.7 (+4) | Not exploited |
| CVE-2026-97631 | 9.5 | Pre-boot RCE in EDK II PXE driver | — | Not exploited |
| CVE-2026-111497 | 9.2 | Out-of-Bounds Write in Decoder | 1.0.10, 1.1.1, 1.2.1 | Exploited |
| CVE-2022-36764 | 7 | Heap Buffer Overflow in Tcg2MeasurePeImage | — | Not exploited |
| CVE-2022-36763 | 7 | Heap Buffer Overflow in Tcg2MeasureGptTable | — | Not exploited |
| CVE-2024-38796 | 5.9 | CWE-122 | — | Not exploited |
| CVE-2024-38797 | 4.6 | CWE-125 | — | Not exploited |
Why It Matters
Citrix and XenServer tools run core workloads across clouds and data centers. Sourced industry data shows that thousands of teams use XenServer to run virtual machines. In addition, hospitals and banks use Citrix virtual desktops to deliver remote apps. Consequently, bugs in hypervisor controls bring real risks to enterprise data. Intruders can breach isolated virtual machines. They can also crash entire server pools.
Fortunately, Citrix confirmed no active attacks against customer networks for the XenServer flaws. Furthermore, researchers have published no public exploit code for these hypervisor bugs. However, authorities note that attackers have actively exploited the Brotli flaw in other software on the web.
How the Attack Works
The security bulletins detail several distinct flaws in virtualization tools and thin client management.
Host Takeover and Guest Breakout in XenServer
First, the XenServer security update bulletin addresses multiple host compromise bugs. The most critical flaw is CVE-2026-98432. It is an IPv4 bug with a 9.8 CVSS score. In the advisory, XenServer warns: “An issue has been identified that may allow an unauthenticated attacker on the management network to compromise the host and/or any running Workload Balancing (WLB) or Conversion Manager appliances.” When systems process concurrent IPv4 connection requests, race bugs free socket options too early. In turn, memory corruption lets attackers seize control of management hosts.
Additionally, the bulletin fixes CVE-2026-102703. The advisory states: “A further issue may allow a privileged user in a guest VM to compromise the host.” This breakout flaw breaks virtual machine isolation.
Pre-Boot PXE Remote Code Execution
Meanwhile, a cluster of firmware bugs impacts virtual machine network boots. The vendor warns that an attacker on the same network can compromise a booting VM or bypass secure boot. This group includes CVE-2026-97631. It allows pre-boot remote code execution during PXE boot over IPv4 or IPv6. It also includes CVE-2026-45447 in OpenSSL, alongside older EDK2 bugs.
Buffer Overflow in Unicon Scout
Second, the Citrix security advisory for Unicon eLux Scout resolves CVE-2026-111497. This critical buffer overflow in Google’s Brotli decoder stems from an unchecked return value. Attackers can send a crafted compressed stream to corrupt memory or execute arbitrary code.
Affected Versions
These Citrix security vulnerabilities affect XenServer 8.4 and XenServer 9. CVE-2026-98432 also affects Workload Balancing before version 2026.1.1 and Conversion Manager before 2026.2.0. In addition, CVE-2026-111497 impacts UniconOS Management (Scout) On-Prem and Scout Cloud Gateway.
Patch and Mitigation Steps
Administrators should apply vendor fixes immediately. For XenServer, teams must update hosts via the Early Access or Normal channels. The vendor notes: “We recommend that customers update to versions 2026.1.1 or later of Workload Balancing and 2026.2.0 of Conversion Manager.” For Scout systems, teams must apply Hotfix 2609.1, 2508 CU2 LTSR, or Scout Cloud Gateway 1 2605.1-3.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
