Can an ordinary client or guest subnet reach your XenServer management network? Check that first. Citrix says someone with that access can potentially infer a pool’s shared secret without signing in.
What changed on November 10
CTX697316 covers XenServer 8.4 and 9. Citrix rates the bulletin High and gives no numeric CVSS score for the XenServer issues. CVE-2026-102705 can let an unauthenticated actor on the management network infer the Pool Secret over time and compromise the host.
CVE-2026-102706, CVE-2026-102707, CVE-2026-102708, CVE-2026-119779 and CVE-2026-119780 concern authenticated host roles. Citrix describes escalation from Pool Operator, VM Power Administrator or VM Administrator to Pool Administrator, and termination of other roles’ tasks by a signed-in host administrator. The bulletin does not map each CVE to an individual effect.
The same update delivers AMD microcode and product changes for CVE-2024-21963, a guest-to-host risk on affected AMD hardware, and CVE-2024-36350, CVE-2024-36357 and CVE-2026-0004, which can expose active memory from another guest on an affected AMD Zen 5 host. Check the actual CPU model and vendor applicability.
Citrix gives no active-exploitation or public proof-of-concept status in CTX697316. None of the bulletin’s CVEs appears in the checked CISA KEV catalog. No federal KEV deadline applies.
Apply the update and verify the pool
Suggested MSP priority is expedited for affected pools, with management networks reachable from untrusted segments first. Inventory all hosts in each pool, their update channel, CPU model and delegated administrator roles. Check management reachability from guest, customer and remote-access networks. Restrict unnecessary access while arranging the update. Citrix supplies no complete workaround.
Citrix released fixes to the Normal and Early Access channels for both XenServer 8.4 and 9. Use the November 10 security update or a superseding update from the pool’s chosen channel. The bulletin does not publish a narrower affected build range or a single fixed build number. Verify the update in XenCenter on every host, complete the required post-update tasks, and test pool membership, workload migration and storage health.
Citrix provides a Pool Secret rotation procedure. If you suspect compromise, isolate the affected management path, preserve host and network evidence, and coordinate rotation with incident response. The pool documentation also directs customers to change the root password when rotating due to suspected compromise. Confirm pool and administrator access after rotation.
Official sources
Citrix CTX697316 · XenServer 8.4 Normal channel · XenServer 9 Normal channel · XenServer 8.4 rotation guidance · XenServer 9 rotation guidance · AMD CPU advisory · CISA KEV data
Vendor publication November 10, 2026. Last verified November 11, 2026 (US Eastern).