Threat reportVulnerabilityTL-2026-3686
Citrix XenServer 8.4/9 Vulnerabilities Enabling Host Compromise (CVE-2026-79610, CVE-2026-102700, CVE-2026-102701, CVE-2026-79611)
Citrix XenServer 8.4/9 Vulnerabilities Enabling Host (TL-2026-3686), also tracked as CTX697170, is a high-severity software vulnerability scored CVSS 8.8, first published 2026-10-16. It has no confirmed attribution, affects Cloud Software Group (Citrix) XenServer, references 4 CVEs (CVE-2026-79610, CVE-2026-102700, CVE-2026-102701), maps to 3 MITRE ATT&CK techniques (T1078, T1499.004, T1611), and is covered by 9 detection rules and 8 indicators of compromise.
- CVSS
- 8.8/10High
- CVEs
- 4Referenced vulnerabilities
- Techniques
- 3MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-3686
- Threat ID
- TL-2026-3686
- Also known as
- CTX697170, XSA-517, XSA-518, XSA-520, XSA-521
- Severity
- HIGH
- CVSS
- 8.8
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- cloud-hosting, technology, enterprise-virtualization, managed-service-providers
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 8
How Citrix XenServer 8.4/9 Vulnerabilities Enabling Host works
Cloud Software Group patched four high-severity vulnerabilities in XenServer 8.4 and XenServer 9 (bulletin CTX697170, 2026-10-13), corresponding to Xen advisories XSA-517, XSA-518, XSA-520 and XSA-521. Three can let a privileged guest user compromise or crash the host; one lets an unprivileged guest user crash its own VM. No exploitation, PoC or KEV listing has been reported.
Citrix (Cloud Software Group) bulletin CTX697170, initially published 2026-10-13, covers four vulnerabilities in XenServer 8.4 and XenServer 9, all rated High by the vendor. CVE-2026-79610, CVE-2026-102700 and CVE-2026-102701 allow a malicious privileged user inside a guest VM to compromise or crash the host; CVE-2026-102700 affects XenServer 8.4 only. CVE-2026-79611 lets an unprivileged guest user crash the same guest VM. Fixes were pushed to the Early Access and Normal update channels for both XenServer 8.4 and 9. The bulletin gives no CVSS, CWE, root cause, credits or workarounds.
The upstream Xen Project advisories published 2026-10-13 12:00 UTC supply the technical detail. CVE-2026-79610 (XSA-517, 'grant-table: double version change race') follows the earlier partial fix in XSA-501: a v2 -> v1 -> v2 grant table version change frees the status pages during the first change and allocates them again during the second, leaving stale pointers into the status array. Xen says an unprivileged guest may be able to elevate its privileges to those of the host, with information disclosure and denial of service also possible. It affects Xen 4.0 and later, x86 guests using grant table v2, multi-vCPU guests only, and hypervisors built with CONFIG_GRANT_TABLE. Workarounds are the hypervisor command-line option gnttab=max-ver:1 or the guest option max_grant_version=1.
CVE-2026-102700 (XSA-520, 'gnttab: cache-flush handling may cause page reference leak') is a flaw in the GNTTABOP_cache_flush error path. The XSA-232 fix added a NULL check but did not drop the page reference when the page belongs to special domains such as DOM_IO or DOM_COW. The most likely outcome is denial of service of Domain 0 (and so likely the whole host) or of another domain. It affects x86 Xen 4.5 through 4.20 and has no known mitigation; Andrew Cooper (Citrix) and Yehyeong Lee found it independently.
CVE-2026-102701 (XSA-521, 'tapdisk: Out-of-bounds access in tap_ctl_connect_xenblkif()') is in tapdisk, the userspace xen-blkback implementation used by the XAPI toolstack. Multi-page ring negotiation has no bounds check on the ring size requested by the frontend and assumes it does not exceed 8. A faulty or hostile guest can trigger a stack overflow, potentially giving arbitrary code execution, and tapdisk normally runs as root. All tapdisk versions are affected and there is no mitigation before patching.
CVE-2026-79611 (XSA-518, 'VMX: VMentry failure with branch tracing and blocked states') builds on XSA-308: a sub-case with branch tracing enabled bypasses the earlier protection against problematic CPU states at VMX entry (debug traps intercepted with single-stepping and STI/MovSS blocking). HVM/PVH guest userspace can crash the guest. Only Intel, VIA and Zhaoxin VMX systems are affected; PV guests, AMD, Hygon and Arm are not. Mitigation is to run only PV guests or to run HVM guests on AMD/Hygon hardware.
XSA-517, XSA-518 and XSA-521 credit discovery to Claude Opus, with Teddy Astie (Vates) identifying the security implications. SUSE rated its Xen update SUSE-SU-2026:4642-1 (2026-10-13) Important and listed CVSS v4.0 9.3 (v3.1 8.8) for CVE-2026-79610, 6.8 (v4.0) for CVE-2026-79611 and 5.7 (v4.0) / 4.7 (v3.1) for CVE-2026-102700. The cvss_score recorded here is that SUSE v3.1 value for CVE-2026-79610, since the Citrix bulletin gives none. Risk is highest in multi-tenant and hosting environments where guest administrators are not vetted, because host compromise can expose other tenants' workloads. No active exploitation, public PoC, KEV listing or attribution has been reported (EPSS for CVE-2026-79610 is about 0.18%). No network IOCs exist; the IOCs below are patch artifacts, affected components and configuration indicators. CWE mappings are analyst-assigned from the advisory descriptions, not stated by the vendor.
MITRE ATT&CK techniques used in TL-2026-3686
Initial Access
Impact
T1499.004 Application or System Exploitation
Privilege Escalation
Affected products and versions in Citrix XenServer 8.4/9 Vulnerabilities Enabling Host
- Cloud Software Group (Citrix) — XenServer
Vulnerable versions: 8.4 (CVE-2026-79610, CVE-2026-102700, CVE-2026-102701, CVE-2026-79611); 9 (CVE-2026-79610, CVE-2026-102701, CVE-2026-79611)
Fixed in: Updates in Early Access and Normal channels per CTX697170 (2026-10-13) - Xen Project — Xen hypervisor / tapdisk
Vulnerable versions: CVE-2026-79610: Xen 4.0 and later (x86, grant table v2, multi-vCPU); CVE-2026-102700: Xen 4.5 through 4.20 (x86); CVE-2026-102701: all tapdisk versions; CVE-2026-79611: all Xen on VMX hardware (HVM/PVH guests)
Fixed in: Patches xsa517.patch, xsa520.patch, xsa521.patch and XSA-518 patches for 4.17.x-4.21.x
Remediation for Citrix XenServer 8.4/9 Vulnerabilities Enabling Host
Patches
- XenServer 8.4 and XenServer 9 updates referenced in CTX697170 (2026-10-13)
- Upstream Xen patches xsa517.patch, xsa520.patch, xsa521.patch and the XSA-518 patches
- SUSE-SU-2026:4642-1 for SUSE-packaged Xen
Immediate actions
- Apply the CTX697170 updates (Early Access or Normal channel) to all XenServer 8.4 and XenServer 9 hosts
- Prioritize hosts running untrusted or multi-tenant workloads where guest administrators are not vetted
- Reboot hosts after patching as required by the update procedure
Workarounds
- CVE-2026-79610 (upstream Xen): set gnttab=max-ver:1 on the hypervisor command line or max_grant_version=1 in guest configuration
- CVE-2026-79611 (upstream Xen): run only PV guests, or HVM guests on AMD or Hygon hardware
- No mitigation exists for CVE-2026-102700 or CVE-2026-102701 before patching; the Citrix bulletin lists no workarounds
Longer-term hardening
- Restrict who holds privileged (administrator/root) access inside guest VMs on shared hosts
- Subscribe to Citrix security bulletins and Xen Project XSA announcements
- Monitor dom0 for unexpected tapdisk crashes and host or guest crash events
CVEs associated with Citrix XenServer 8.4/9 Vulnerabilities Enabling Host
CVE-2026-79610, CVE-2026-102700, CVE-2026-102701, CVE-2026-79611
Weaknesses (CWE) in Citrix XenServer 8.4/9 Vulnerabilities Enabling Host
Timeline of Citrix XenServer 8.4/9 Vulnerabilities Enabling Host
- CVE-2026-79610 published; no public PoC or KEV listing observed, EPSS about 0.18%
- SUSE publishes SUSE-SU-2026:4642-1 Xen update (Important) addressing CVE-2026-79610, CVE-2026-79611 and CVE-2026-102700
- Fixes pushed to the Early Access and Normal update channels for XenServer 8.4 and XenServer 9
- Citrix publishes security bulletin CTX697170 covering CVE-2026-79610, CVE-2026-102700, CVE-2026-102701 and CVE-2026-79611 for XenServer 8.4 and 9
- Xen Project publicly releases XSA-517, XSA-518, XSA-520 and XSA-521 at 12:00 UTC; XSA-517/518/521 credit Claude Opus with discovery
- GBHackers reports the XenServer fixes, noting no active exploitation and highest risk in multi-tenant environments
Sources cited for Citrix XenServer 8.4/9 Vulnerabilities Enabling Host
- Citrix XenServer Security Update CTX697170
- Xen XSA-517 - grant-table: double version change race (CVE-2026-79610)
- Xen XSA-518 - VMX: VMentry failure with branch tracing and blocked states (CVE-2026-79611)
- Xen XSA-520 - gnttab: cache-flush handling may cause page reference leak (CVE-2026-102700)
- Xen XSA-521 - tapdisk: Out-of-bounds access in tap_ctl_connect_xenblkif() (CVE-2026-102701)
- Xen Security Advisories index
- SUSE-SU-2026:4642-1 Xen security update
- CVE-2026-79610 entry (thehackerwire)
- Citrix Patches XenServer Vulnerabilities That Could Enable Host Compromise (GBHackers)
Detection coverage for TL-2026-3686
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3686 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.