XenServer Security Update for CVE-2026-79610, CVE-2026-79610, CVE-2026-102700 and CVE-2026-102701
CTX697170
Summary
XenServer's internal list of trusted certificate authorities (CAs) included a public CA whose intermediate certificates have been found to have weak keys. This would allow a malicious attacker on the management network to forge TLS certificates that appeared to be signed by that trusted CA and so appear to a XenServer host to be a trusted LDAPS server, potentially authorising attacker access.
Products covered
XenServer
Remediation
We have pushed updates to both the Early Access and Normal update channels of each of XenServer 8.4 and XenServer 9. We recommend that customers update to the latest version from their chosen channel following the instructions at https://docs.xenserver.com/us/en/xenserver/8/update.html or https://docs.xenserver.com/us/en/xenserver/9/update.html
CVEs in this advisory 1
Updates
- Published by Citrix
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.