Back to vendor advisories
Citrix Security BulletinsCTX695195

XenServer Security Update for CVE-2025-27466, CVE-2025-58142, CVE-2025-58143 and CVE-2025-58146

High 4 CVEs Published May 3, 2026 at 5:38 AM UTC

Summary

Several issues have been identified in XenServer 8.4 that collectively may allow privileged code in a guest VM to compromise or crash the host.

Products covered

  • XenServer

  • These issues affect XenServer 8.4. (Note that Citrix Hypervisor 8.2 CU1 is now End of Life (EoL) and so no longer receives security updates or security bulletins.)

Remediation

We have pushed updates to both the Early Access and Normal update channels of XenServer 8.4. We recommend that customers update to the latest version from their chosen channel following the instructions at https://docs.xenserver.com/en-us/xenserver/8/update

CVEs in this advisory 4

Updates

  1. Published by Citrix

    The publication date reported by the vendor.

  2. Added to SecurityAlert

    We collected the advisory from the official source.