If your Citrix estate includes eLux thin clients, give them a patch ticket of their own. The endpoint’s running kernel is what closes it.
New November 10, 2026. Citrix published CTX697335 for CVE-2026-98432, a Linux kernel use-after-free in IPv4 TCP connection handling. Canonical rates the underlying kernel issue Critical, CVSS 3.1 9.8, and says remote code execution is possible. Citrix’s UniconOS bulletin supplies no separate product score or configuration prerequisite. Check which thin-client interfaces and IPv4 services are reachable across customer networks.
Match the kernel package to the release track
| UniconOS track | Affected releases | Citrix package |
|---|---|---|
| Current Release | 2609 and earlier | kernel-6.18.59.7.2609.0-1 |
| Long Term Service Release | 2603 LTSR CU2 and earlier | kernel-6.18.59.7.2603.2000-1 |
Citrix urges affected customers to install the matching package as soon as possible. For an older base image, confirm the supported upgrade path before rollout. The download links are published; access to the package payload was unverified.
Citrix gives no UniconOS-specific exploitation status, workaround, compromise check or credential-rotation direction. CISA’s checked KEV catalog has no entry, so there is no federal KEV due date for this CVE.
Roll out by customer and verify the running kernel
Suggested MSP priority is high for confirmed affected endpoints. Inventory eLux builds and IPv4 reachability. Restrict unnecessary inbound access while staging and isolate suspicious devices through incident response. Pilot the matching Citrix package, reboot, confirm the running kernel, then verify broker sign-in and a normal session before widening the rollout. Network restrictions reduce exposure while the patch is staged.
Citrix bulletin · Canonical kernel assessment · CISA KEV catalog data
Original Citrix publication November 10, 2026. Last verified November 11, 2026.