# Citrix XenServer Security Bypass Flaw Patched

Published: 2026-10-26 · Severity: routine · Sectors: Technology
Canonical: https://vorant.io/reports/90ab1340-999b-5d37-b7cb-b2498f0bd3b7/citrix-xenserver-security-bypass-flaw-patched

> CERT-FR advises a security policy bypass vulnerability in Citrix XenServer 8.4 and 9 without the latest patch, with a fix available.

CERT-FR issued an advisory regarding a vulnerability in Citrix XenServer affecting versions 8.4 and 9 that lack the latest security patch. The flaw, tracked as CVE-2026-114406, allows an attacker to bypass the system's security policy. No details on exploitation in the wild are provided in this advisory.

Citrix has released a security bulletin (CTX697257, dated October 23, 2026) addressing this issue. Defenders running affected XenServer versions should apply the vendor-supplied patch referenced in the Citrix bulletin to remediate the vulnerability.

## Mentioned in this report

- Vulnerabilities: CVE-2026-114406

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1384

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/90ab1340-999b-5d37-b7cb-b2498f0bd3b7/citrix-xenserver-security-bypass-flaw-patched.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup