Critical Citrix XenServer Vulnerabilities Allow Remote Attackers to Compromise Virtualization Hosts

Citrix released critical advisories (CTX697256, CTX697300) covering multiple XenServer vulnerabilities—including CVE-2026-98432 (unauthenticated management‑network host compromise), CVE-2026-102703 (privileged guest-to-host compromise), and six CVEs impacting PXE/UEFI/Secure Boot protections—and separately disclosed CVE-2026-111497 (an unchecked Google Brotli return value) impacting UniconOS Scout. Citrix provides fixes and appliance updates (Workload Balancing 2026.1.1+, Conversion Manager 2026.2.0, Scout hotfixes and CU/LTSR updates) but the advisories do not include exploit details or evidence of active exploitation.