Critical Citrix XenServer Flaw Allows Unauthenticated Attackers to Take Control of Virtualization Hosts

Citrix released security updates for XenServer 8.4 and 9 addressing nine CVEs, highlighted by CVE-2026-98432 — a critical flaw that could allow an unauthenticated attacker on the management network to compromise hosts (and affected WLB/Conversion Manager appliances). The bulletin also details a guest-to-host escape (CVE-2026-102703) and multiple PXE/secure-boot vulnerabilities that risk compromising PXE-booting VMs or bypassing secure boot; Citrix has pushed fixes to update channels and recommends immediate patching and tightening management-network access.