Citrix Discloses Seven Vulnerabilities Across UniconOS and XenServer

Citrix disclosed seven vulnerabilities across UniconOS and XenServer on October 13, 2026. The most severe allow a malicious guest virtual machine to compromise or crash the underlying hypervisor host in XenServer, and local privilege escalation to root in UniconOS. Patches are available for all affected versions.

Two Citrix security bulletins published October 13 address vulnerabilities in UniconOS (formerly eLux) and XenServer versions 8.4 and 9.

In UniconOS, CVE-2026-53562 (CVSS 8.5) allows a locally authenticated, low-privileged user to escalate privileges to root via link following. CVE-2026-53563 enables persistent command execution through incorrect permission assignment. CVE-2026-53564 allows arbitrary file reads and writes when a target is within range of an attacker-controlled wireless access point. UniconOS users should upgrade to version 2607.2 or later, or to 2603 LTSR CU2 or later for LTSR deployments.

In XenServer, CVE-2026-79610, CVE-2026-102700, and CVE-2026-102701 allow a malicious privileged guest VM user to compromise or crash the underlying hypervisor host. CVE-2026-102700 affects XenServer 8.4 only. A separate flaw, CVE-2026-79611, allows an unprivileged guest user to crash their own VM without host-level impact. Fixes are available through the Early Access and Normal update channels for both XenServer releases. Neither bulletin describes confirmed exploitation in the wild.

citrix.com — AEO Score: 87.0 / B

One adverse signal noted from a single source without corroboration across independent sources reviewed.