XenServer Security Update for CVE-2026-114406
CTX697257
Summary
An issue has been identified in the XenServer management API SDK that may allow an attacker on the management network who is able to intercept specific HTTPS requests within a higher-level operation to be able to act with the privileges of the intercepted administrator. This issue affects the XenCenter management agent together with third-party PowerShell and C# SDK clients.
Products covered
XenServer
Remediation
We have released updated versions of both XenCenter and the SDK. We recommend that customers update their existing XenCenter to the latest version using the built-in update functionality as documented at https://docs.xenserver.com/en-us/xencenter/current-release/updates-xencenter.html We recommend that customers using the SDK download the latest version from https://www.xenserver.com/downloads
CVEs in this advisory 1
Update history
What changed in later vendor updates
SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.
- Removed affected products: This issue affects XenCenter versions before 2026.4.0 and, for PowerShell and C# clients only, SDK versions before 26.15.0. As the issue is in the client-side (XenCenter and SDK) code, it is independent of the version of....
- The vendor changed its remediation guidance.
- The vendor changed the advisory's last-updated date.
Updates
- Published by Citrix
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.