Citrix published bulletin CTX697256, “XenServer Security Update for Multiple Issues”, on 3 November 2026 and rates it Critical. The headline issue may let an unauthenticated attacker on the management network compromise a XenServer host and any running Workload Balancing or Conversion Manager appliance. It affects XenServer 8.4 and XenServer 9, and the fix is the latest update in your update channel.
Which Versions Does the Bulletin Fix?
| Product | Affected | What Citrix tells you to run |
|---|---|---|
| XenServer 8.4 | All issues in the bulletin | The latest update from your chosen channel, Early Access or Normal |
| XenServer 9 | All issues in the bulletin | The latest update from your chosen channel, Early Access or Normal |
| Workload Balancing | Before 2026.1.1, headline issue only | 2026.1.1 or later |
| Conversion Manager | Before 2026.2.0, headline issue only | 2026.2.0 or later |
The bulletin names no build numbers for the XenServer updates, so read the version from the update documentation for your release. Citrix says the appliance builds are on the XenServer downloads page.
Why Does the Management Network Decide Your Exposure?
The bulletin says the attacker must be on the management network. That is the segment where hosts, pool coordination and appliances talk to each other, so an unauthenticated flaw there bypasses every account control you set up inside the pool.
A host that is compromised through its management interface gives an attacker the virtual machines it runs. Appliances such as Workload Balancing and Conversion Manager are named in the same sentence, so treat them as part of the exposed surface. The bulletin gives no root cause or exploit chain, and we do not guess one.
Which Other Issues Ship in the Same Bulletin?
Citrix lists a second issue that may let a privileged user in a guest VM compromise the host. A further group may let an unauthenticated attacker on the same network compromise a PXE-booting VM during its initial boot, or let a guest administrator bypass the secure boot policy. All of them affect XenServer 8.4 and 9, so one update covers them.
The bulletin carries no CVSS 3.1 or 4.0 vector or score. Citrix does not state whether any issue is exploited, and CISA KEV catalogue version 2026.11.04 holds none of the identifiers the bulletin lists.
What Does CVE-2026-98432 Cover?
The bulletin attaches CVE-2026-98432 to the headline issue but does not name the component behind it. The CVE.org record under that identifier describes a Linux kernel IPv4 use-after-free, published on 15 October 2026 by the Linux CNA. Our CVE-2026-98432 page covers the kernel flaw itself.
Track this issue by the bulletin number CTX697256 and apply the XenServer update from your channel. The bulletin does not say how the update relates to the kernel record, so a scanner result for the kernel flaw is not proof that a host is patched.
What Should You Do Now?
- List every pool and applianceRecord XenServer 8.4 or 9, plus Workload Balancing and Conversion Manager versions.
- Check management reachabilityConfirm which networks and jump hosts can reach the management interfaces, and cut anything that does not need to.
- Update the appliancesMove Workload Balancing to 2026.1.1 or later and Conversion Manager to 2026.2.0 or later.
- Update each poolApply the latest update from your channel, following the XenServer update guide for your release.
- Review management logsLook at the period from 3 November for logins and commands from addresses outside your admin ranges.
Our entries on network segmentation and patch management cover the controls behind steps 2 and 4. The remote code execution entry explains what host takeover allows. For an earlier hypervisor escape, see our page on the VMware ESXi sandbox escape.