Description:
Citrix has released security updates to address multiple vulnerabilities in several Citrix products or components. An attacker could exploit these vulnerabilities by sending specially crafted requests to an affected system.
Affected Systems:
- XenServer versions 8.4, 9
- Citrix Workload Balancing (before 2026.1.1)
- Citrix Conversion Manager (before 2026.2.0)
For detailed information of the affected systems, please refer to the corresponding security advisories at vendor's website.
Impact:
Successful exploitation of the vulnerabilities could lead to remote code execution, denial of service, information disclosure or tampering on an affected system.
Recommendation:
Patches for affected systems are now available. System administrators of affected systems should follow the recommendations provided by the product vendor and take immediate actions to mitigate the risk.
More Information:
- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697256&articleURL=XenServer_Security_Update_for_Multiple_Issues
- https://www.hkcert.org/security-bulletin/citrix-xenserver-multiple-vulnerabilities_20261104
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36763 (to CVE-2022-36764)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38796 (to CVE-2024-38797)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45447
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-97631
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98432
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-102703