Citrix has published bulletin CTX697256, closing nine XenServer vulnerabilities. An unauthenticated attacker on the management network can take over an entire host.
Cloud Software Group, the owner of Citrix, published security bulletin CTX697256 for XenServer on 3 November 2026, rated Critical. The bulletin closes nine vulnerabilities at once. The most serious of them lets an attacker with no credentials take over an entire host from the management network.
What happened
The headline issue is CVE-2026-98432. An unauthenticated attacker who can reach the management network is able to compromise the XenServer host along with any Workload Balancing or Conversion Manager appliances running on it. XenServer 8.4 and XenServer 9 are affected, as are Workload Balancing releases before 2026.1.1 and Conversion Manager before 2026.2.0.
The second critical item, CVE-2026-102703, puts the attacker inside rather than outside. A privileged user within a guest virtual machine can compromise the host, which means the isolation between virtual machines no longer holds.
The remaining flaws concern network boot and Secure Boot: an attacker on the same network can compromise a virtual machine as it boots over PXE, and a guest administrator can bypass Secure Boot.
Why it matters
The first reason is the layer involved. This is not one application but the virtualisation layer itself. Once a hypervisor falls, every virtual server on it goes with it at the same moment — domain controller, file server, accounting and ERP systems alike. Antivirus or EDR running inside a virtual machine has no visibility into that layer at all.
The second reason is quieter but just as awkward: Citrix published no CVSS score for these flaws. On top of that, the identifier CVE-2026-98432 is also recorded against an unrelated Linux kernel IPv4 vulnerability, and the 9.8 score attached to that one does not belong to the Citrix issue. Patch processes that prioritise by score alone can miss this bulletin entirely. Track it by the bulletin number CTX697256, not by the CVE.
What this means for businesses in Türkiye
What we see in the field is consistent: in most mid-sized companies the entire server estate sits on one virtualisation host, often a single physical machine. For construction offices, shipping agencies, logistics operators and manufacturing sites, that is a single critical point with no redundancy behind it.
The sharper risk is where the management interface sits. In many corporate networks it shares a VLAN with user workstations and is reachable from any desk in the office. This bulletin punishes exactly that design: the attacker only needs to reach the management network, and needs no password.
The data protection consequences are heavy too. A single hypervisor can hold HR records, customer data and camera footage side by side. A decision of the Turkish Personal Data Protection Board dated 24 January 2019 requires breaches to be reported within 72 hours of becoming aware of them. After a hypervisor-level compromise, establishing which data was affected inside that window is not possible without adequate logging.
What Kamer Bilişim recommends
- Build the inventory, then plan the patch. List the versions of every XenServer pool and of your Workload Balancing and Conversion Manager appliances. Move Workload Balancing to 2026.1.1 and Conversion Manager to 2026.2.0, and apply the latest XenServer update in the channel you use.
- Separate the management network from the user network. Allow the hypervisor management interfaces to be reached only from specific administrator machines or a jump host. This protects you during the window before patching and keeps paying off long after.
- Review management logs from 3 November onward. Look for logins and commands from outside your administrative address ranges, then audit administrator rights inside guest virtual machines and check which segments still allow PXE boot.
If you would like to go through the version status of your virtualisation infrastructure and who can reach its management network, you can reach us through our contact page.
Source: GBHackers, "Critical Citrix XenServer Flaw Allows Unauthenticated Attackers to Take Control of Virtualization Hosts", 5 November 2026; Citrix security bulletin CTX697256, 3 November 2026.
Source: GBHackers