Citrix has fixed a CVSS 9.8 race condition in XenServer, CVE-2026-98432, that lets an unauthenticated attacker on the management network compromise the host, alongside pre-boot code execution flaws and a critical Brotli bug in its Scout products. Cloud Software Group’s bulletins, issued Wednesday, state that no attacks against customers have been confirmed and no public exploit code exists for the XenServer flaws.
CVE-2026-98432 Frees IPv4 Socket Options Too Early in XenServer
The critical flaw is an IPv4 race condition in which socket options are freed too early. An unauthenticated attacker with access to the management network can use it to compromise the XenServer host and any Workload Balancing (WLB) or Conversion Manager appliance. It affects XenServer 8.4 and 9. The same CVE was handled in Linux distribution fixes in late October.
Fixed Versions for WLB and Conversion Manager
Customers should update XenServer through the Early Access or Normal channels. The bulletins list Workload Balancing 2026.1.1 or later and Conversion Manager 2026.2.0 as the fixed releases for those appliances; earlier versions are affected.
XenServer Guest Escape CVE-2026-102703 Matches the Xen XSA-523 Bug
The bulletins also list CVE-2026-102703, which allows a privileged guest user to compromise the host. It is the same vulnerability Xen disclosed in advisory XSA-523, in which a guest can read and write memory belonging to other virtual machines. Citrix describes the effect on XenServer as a guest-to-host breakout.
Pre-Boot Flaws in PXE Boot Open a Path Around Secure Boot
CVE-2026-97631 allows code execution before the operating system loads, during PXE boot over IPv4 or IPv6. Citrix pairs it with CVE-2026-45447 in OpenSSL and a set of older EDK2 bugs. Together they let an attacker on the same network compromise a booting virtual machine or bypass secure boot.
These flaws matter because they act before the guest operating system and its security tools start. Network boot is common in virtualized environments that provision machines automatically. The CVE-2026-98432 advisory also reaches beyond the host itself: the WLB and Conversion Manager appliances are compromised along with it.
A Brotli Decoder Flaw Reaches the Scout Management Products
Separately, the bulletins cover the Scout products, UniconOS Management (Scout) On-Prem and Scout Cloud Gateway. CVE-2026-111497 is a critical buffer overflow in Google’s Brotli decoder that stems from an unchecked return value. A crafted compressed stream can corrupt memory or execute code. The reporting on the bulletins notes that Brotli flaws have been exploited in other software. An unchecked return value is a coding error in which a function reports failure and the calling code carries on regardless.
Scout Hotfix and Gateway Releases
Citrix lists Scout Hotfix 2609.1, 2508 CU2 LTSR, and Scout Cloud Gateway 1 2605.1-3 as the fixed builds.
XenServer and Scout Flaws Put Virtualization Infrastructure at Risk
The bulletins together cover host takeover, guest escape and pre-boot code execution. All of these sit on infrastructure that hosts other workloads, so a successful attack on one XenServer host affects each virtual machine on it. Citrix confirmed no attacks against customers for the XenServer flaws and says no public exploit code exists.
The management-network condition on CVE-2026-98432 narrows the attack surface to attackers who already have a position on that network, though unauthenticated access at that position needs no credentials. Organizations that keep management interfaces on isolated segments are in a different risk class from those that expose them more widely.
The Scout entry shows a different pattern: a flaw in a widely used third-party compression library reaches Citrix’s products through a dependency, which means the fix depends on Citrix shipping rebuilt packages rather than on the library’s own maintainers alone.
