Citrix Issues Critical XenServer Patches for Host Compromise Vulnerabilities
Citrix has released security bulletin CTX697256 detailing eight vulnerabilities in XenServer. The advisory, published on 3 November 2026, addresses issues that could allow attackers to compromise virtualization hosts and supporting appliances.
The most severe vulnerability, registered as CVE-2026-98432 and classified as critical, permits an unauthenticated attacker to compromise the virtualization host. Exploitation requires the attacker to reach the management network used by administrators, rather than the network carrying user virtual machine traffic. The bulletin does not report any ongoing exploitation or association with malware, and Citrix did not disclose the underlying programming error.
A second flaw, identified as CVE-2026-102703, originates from within a guest virtual machine. A user with privileges inside the guest can compromise the host running it, thereby breaking the isolation that virtualization is intended to provide. The remaining six vulnerabilities lack individual identifiers and affect network boot and secure boot mechanisms.
Compromising the host grants access to all virtual machines running on it, including their disk, memory, and network resources. The bulletin outlines two attack scenarios for these six issues: an unauthenticated attacker on the same network can compromise a virtual machine during network boot, and an administrator inside a guest can bypass its secure boot policy, undermining the guarantee that only signed code is loaded.
Affected products are XenServer 8.4 and XenServer 9, as well as the Workload Balancing and Conversion Manager appliances. Fixes for the two XenServer versions are available through Normal and Early Access channels. For the appliances, Citrix recommends Workload Balancing 2026.1.1 or later and Conversion Manager 2026.2.0.
While patches are being applied, Citrix advises isolating the management network and restricting it to known administrative stations. Organizations should also review user privileges inside guest virtual machines, as the second vulnerability can be exploited from within a guest. Administrators running the affected appliances should include them in the same update cycle.
Related articles
Microsoft Paint Patch for CVE-2026-83844 Fails to Reach Some Windows 11 Users via Microsoft Store
Microsoft fixed a remote code execution vulnerability in the Paint application for Windows 11, but the update is not reaching all users through the Microsoft Store. The flaw, tracked as CVE-2026-83844, carries a CVSS score of 8.1 and involves an out-of-bounds memory read that could allow unauthenticated network attacks. Although exploitation is rated as highly complex, the issue is classified as important by Microsoft. The patch is delivered separately from Windows Update, requiring users to verify the Paint version manually in the Microsoft Store. The clean version is listed as 11.2609.401.0, yet multiple systems remain on 11.2603.251.0 despite automatic updates being enabled. Windows Latest reported the distribution problem after checking its own systems and collecting similar reports from administrators. No real-world exploitation of the vulnerability has been observed so far.
Mozilla Releases Firefox 159.0.1 to Patch High-Severity Layout Vulnerability CVE-2026-120572
Mozilla Foundation has issued Firefox 159.0.1 to address a high-severity vulnerability tracked as CVE-2026-120572. The flaw resides in the Layout: Block and Inline component responsible for web page rendering. It stems from improper handling of boundary conditions during layout processing. CISA assigned the issue a CVSSv3.1 base score of 8.8, confirming high impact. The update was published on November 3, 2026, and is rated high severity by both Mozilla and CISA. Users are advised to apply the patch immediately to mitigate potential exploitation risks.
WatchGuard AuthPoint Authentication Gateway Hit by Four Critical Vulnerabilities
WatchGuard disclosed four security advisories for its AuthPoint multi-factor authentication solution on November 4, 2026. Three of the issues received a Critical rating while one was rated High. The flaws reside in the AuthPoint Authentication Gateway component and affect environments integrated with LDAP and Active Directory. CVE-2026-121639 allows unauthenticated attackers to disrupt authentication services or delete directory synchronization settings over the network. The remaining three vulnerabilities enable man-in-the-middle attacks, capture-replay actions, and forged authentication results. No exploitation in the wild has been observed. WatchGuard has released updated versions to address all reported issues.
sshhole: OpenSSH Authentication Bypass on musl libc Systems Without PAM
An emergency patch for OpenSSH 10.6p2 was released on November 5, 2026, to fix a critical authentication bypass vulnerability affecting Linux systems using musl libc without PAM support. The flaw allowed attackers to log into accounts with a locked password by supplying any string longer than 256 bytes. The root cause traces back to a chain of engineering decisions: musl's crypt() returning '*' on length errors instead of NULL, OpenSSH's 2016 timing attack mitigation that selected salts from real hashes, and the resulting strcmp match between error result and the shadow '*' marker. Exploitation required a specific combination of musl, OpenSSH without PAM, password authentication enabled, and an account marked with '*' in /etc/shadow, notably impacting Alpine Linux cloud images. The vulnerability was discovered by researcher Özgün Kültekin using LLM-assisted fuzzing of 17,600 authentication variants. OpenSSH 10.6p2 or equivalent distribution patches close the issue; until applied, administrators should set PasswordAuthentication no where password login is unnecessary.