Citrix XenServer: Security policy bypass (CVE-2026-114406)
A security policy bypass vulnerability in Citrix XenServer versions 8.4 and 9 allows attackers to circumvent established security controls, as detailed in Citrix bulletin CTX697257.
CVE search metadata
CVE search record: CVE-2026-114406. Severity: medium. CVSS: 6.8. EPSS: 0.31%. KEV: no. Product: XenServer (8.4, 9). Brief: Citrix XenServer: Security policy bypass (CVE-2026-114406). Brief link: https://feed.craftedsignal.io/briefs/2026-10-citrix-xenserver-bypass/
Triage facts
Revision 1- Applicability
- XenServer (8.4, 9)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 3 public sources
- Freshness
- Revision 1Oct 26, 22:20 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
A security policy bypass vulnerability exists in Citrix XenServer versions 8.4 and 9. This vulnerability, tracked as CVE-2026-114406, allows an attacker to circumvent security controls configured within the virtualization environment. Citrix has released security updates to address this flaw; users should refer to bulletin CTX697257 for remediation.
Recommendation
- Inventory all internal deployments of Citrix XenServer 8.4 and 9 to identify instances requiring updates.
- Patch affected XenServer instances immediately by applying the security updates documented in Citrix bulletin CTX697257.
- Restrict administrative access to the XenServer management interfaces to authorized networks only, pending the application of patches.
Mitigations
Apply security updates as detailed in Citrix bulletin CTX697257 to all XenServer 8.4 and 9 instances.
CVE-2026-114406