CITRIX has issued security bulletins addressing six flaws across XenServer and UniconOS, with three XenServer vulnerabilities potentially allowing a privileged guest to impact or crash the host.
The XenServer issues include CVE-2026-79610 (XSA-517) describing a race in grant-table version changes that could enable privilege escalation to the host, CVE-2026-102701 (XSA-521) a stack overflow in tapdisk that could lead to code execution, and CVE-2026-102700 (XSA-520) a page reference leak that may cause denial of service. There is also CVE-2026-79611 (XSA-518), a state-handling bug that could cause an unprivileged user to crash their own guest.
UniconOS receives fixes for CVE-2026-53562 (CVSS 8.5), CVE-2026-53563 (CVSS 6.8), and CVE-2026-53564 (CVSS 5.1), including a high-severity local privilege escalation, persistent command execution via weak permissions, and a read/write capability for files when a rogue Wi‑Fi access point is used to trigger a captive portal.
Exploitation status remains unconfirmed in the wild for all seven vulnerabilities. Affected versions are XenServer 8.4 and 9 (with CVE-2026-102700 affecting XenServer 8.4) and UniconOS releases prior to 2607.2 (Current) or 2603 LTSR CU2. Citrix advises applying the hotfixes listed in CTX697170 for XenServer and upgrading UniconOS to 2607.2 or 2603 LTSR CU2. Until patching, XenServer hosts can consider restricting guests to grant table version 1 as a temporary mitigation for CVE-2026-79610. Both XenServer and UniconOS users are urged to treat this as a priority.