Key points
- XenServer 8.4 and 9 are affected by four distinct vulnerabilities disclosed in October 2026.
- One flaw, CVE-2026-79610, involves a race condition in the grant table version changes.
- Citrix UniconOS versions prior to 2603 LTSR CU2 and 2607.2 also contain three separate flaws.
Citrix XenServer environments running versions 8.4 and 9 are exposed to four new security vulnerabilities, according to an advisory from the Canadian Centre for Cyber Security dated October 13, 2026. The issues include a race condition in the Xen hypervisor’s grant table mechanism, which manages memory sharing between domains. This specific flaw, identified as CVE-2026-79610, stems from a race condition during double version changes, a problem that extends beyond previous advisory XSA-501.
By the numbers
- 4 total vulnerabilities affect Citrix XenServer 8.4 and 9
- 3 separate flaws impact Citrix UniconOS prior to specific update levels
- CVE-2026-102700 and CVE-2026-102701 are two additional CVE IDs in XenServer
What the figures mean
The advisory lists four distinct CVEs for XenServer, indicating multiple underlying issues within the hypervisor layer. CVE-2026-79610 is notable because it involves a "double version change race" in the grant table, a component critical for virtual machine isolation. The fact that this issue was identified as a separate advisory version (XSA-517 v2) suggests the complexity of the race condition. For managed service providers, this means standard patching cycles must account for multiple underlying issues in the same update window.
What should you do?
Administrators should immediately inventory all XenServer 8.4 and 9 instances to confirm exposure. Check whether any virtual machines are sharing memory resources in ways that could trigger the grant table race condition. Review Citrix UniconOS deployments to ensure they are updated to at least 2603 LTSR CU2 or 2607.2. Monitor vendor channels for the release of the specific security updates referenced in the advisory.
Operational impact
Teams usually need to coordinate with infrastructure owners to schedule maintenance windows for applying these updates. Verify that backup systems are current before initiating patches to prevent data loss during the process. Communicate with internal security teams to assess if any suspicious activity aligns with the grant table race condition behavior. Ensure that change management protocols are followed to minimize downtime for critical business applications running on these hypervisors.
What to do and how to stay safe: Citrix
- Audit your environment to identify all instances of XenServer 8.4 and 9.
- Check Citrix UniconOS versions and upgrade if they are below 2603 LTSR CU2 or 2607.2.
- Monitor vendor announcements for the release of the specific security updates.
- Review logs for any unusual memory sharing or domain isolation anomalies.
General security guidance from the BitShield News newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which XenServer versions are affected by the new vulnerabilities?
XenServer Version 8.4 and XenServer Version 9 are affected by the four new vulnerabilities.
What is the specific nature of CVE-2026-79610?
It is a grant-table double version change race condition that was not fully addressed in previous advisories.
Are there any affected versions of Citrix UniconOS?
Yes, UniconOS versions prior to 2603 LTSR CU2 and prior to 2607.2 are affected by three separate flaws.
