XenServer Security Update for CVE-2026-114406
CTX697257
Summary
AMD has disclosed an issue in AMD Zen 2-based CPUs that may allow code in a guest VM to compromise the host. Although this hardware vulnerability is not an issue in the XenServer product itself, for the convenience of customers we are providing an update that mitigates this CPU hardware issue. This issue has the following identifier:
Products covered
XenServer
Remediation
We have pushed updates to both the Early Access and Normal update channels of XenServer 8.4. We recommend that customers update to the latest version from their chosen channel following the instructions at https://docs.xenserver.com/en-us/xenserver/8/update
CVEs in this advisory 1
Update history
What changed in later vendor updates
SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.
- Removed affected products: This issue affects XenServer 8.4. (Note that XenServer 9 is in Public Preview; releases in preview state are not intended for production use and so are not covered by security bulletins until they exit preview state).
- The vendor changed its remediation guidance.
- The vendor changed the advisory's last-updated date.
Updates
- Published by Citrix
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.