XenServer Security Update for CVE-2026-114406
CTX697257
Summary
Two issues have been identified that affect XenServer 8.4 that each may allow a logged-in host administrator to escalate their privileges to a higher level than defined by their RBAC role. These issues have the following identifiers:
Products covered
XenServer
Remediation
We have pushed updates to both the Early Access and Normal update channels of XenServer 8.4. We recommend that customers update to the latest version from their chosen channel following the instructions at https://docs.xenserver.com/en-us/xenserver/8/update
CVEs in this advisory 2
Update history
What changed in later vendor updates
SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.
- Removed affected products: These issues affect XenServer 8.4. (Note that XenServer 9 is in Public Preview; releases in preview state are not intended for production use and so are not covered by security bulletins until they exit preview state.).
- The vendor changed its remediation guidance.
Updates
- Published by Citrix
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.