Citrix has released fixes for a critical XenServer vulnerability that could let an unauthenticated attacker with access to the management network compromise virtualization hosts and supporting appliances. The flaw, CVE-2026-98432, is covered in a November 3 security bulletin, CTX697256, summarized by Cyber Security News.
A second bug, CVE-2026-102703, lets a privileged guest user compromise the host. The affected products are XenServer 8.4 and XenServer 9, along with the Workload Balancing and Conversion Manager appliances. The summary gives no CVSS scores or build numbers.
Fixes for both XenServer releases are available through the Normal and Early Access channels. Workload Balancing should be updated to version 2026.1.1 or later and Conversion Manager to 2026.2.0. No active exploitation has been confirmed, and the bulletin names no malware or campaign.
Because reach to the management network is the central requirement for the headline flaw, administrators should confirm which systems can actually reach it and restrict that access while updates roll out. Citrix also points customers to its hypervisor security best practices for isolating management networks.