XenServer Security Update for CVE-2026-114406
CTX697257
Summary
Several issues have been identified that affect XenServer 8.4 and XenServer 9. Collectively, these issues may allow a malicious privileged user in a guest VM to compromise or crash the host.
Products covered
XenServer
Remediation
We have pushed updates to both the Early Access and Normal update channels of each of XenServer 8.4 and XenServer 9. We recommend that customers update to the latest version from their chosen channel following the instructions at https://docs.xenserver.com/en-us/xenserver/8/update or https://docs.xenserver.com/en-us/xenserver/9/update We have also published an updated Terraform provider, version 0.3.0.
We recommend that customers using the XenServer Terraform provider upgrade to that version, either by using standard Terraform tooling or by downloading the updated version directly from https://github.com/xenserver/terraform-provider-xenserver/releases.
CVEs in this advisory 6
Update history
What changed in later vendor updates
SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.
- Removed affected products: These issues affect both XenServer 8.4 and XenServer 9; versions of the XenServer Terraform provider versions before version 0.3.0 are affected by the Terraform issue..
- The vendor changed its remediation guidance.
Updates
- Published by Citrix
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.