XenServer security update: CVE-2026-114406. Risk of impersonating a trusted LDAPS server

Citrix published security bulletin CTX697257 — “XenServer Security Update for CVE-2026-114406”. Updates are available on the Early Access and Normal channels for XenServer 8.4 and XenServer 9. Initial publication date: 23 October 2026.

What is the issue?

XenServer’s internal list of trusted certificate authorities (CAs) included a public CA whose intermediate certificates have been found to have weak keys.

A malicious attacker on the management network could forge TLS certificates that appeared to be signed by that trusted CA and therefore appear to a XenServer host as a trusted LDAPS server, potentially authorizing attacker access.

Vulnerability identifier: CVE-2026-114406.

Which environments are affected?

According to Citrix, the issue affects:

• XenServer 8.4
• XenServer 9

Only deployments using the LDAPS feature are affected (this feature was introduced in July 2026). Environments without LDAPS are outside this attack scenario.

What does the vendor recommend?

Citrix has pushed updates to both the Early Access and Normal update channels for XenServer 8.4 and XenServer 9.

Recommended actions:

1. Update XenServer hosts to the latest version from your chosen update channel as soon as possible.
2. Follow the official XenServer 8 and XenServer 9 update documentation.
3. Confirm whether LDAPS is enabled and whether directory traffic traverses the management network.
4. Restrict management-network access to trusted segments and administrators only.

Update instructions: docs.xenserver.com (update paths for XenServer 8 and 9).

Why this matters for infrastructure

LDAPS is used for secure directory authentication (e.g. Active Directory). If the hypervisor trusts a forged certificate, an attacker on the management network may influence authorization decisions — without compromising a guest VM.

This is another reminder that management-plane security and the TLS trust chain are as critical as protecting the virtual machines themselves.

Alterkom recommendation

We recommend that XenServer administrators promptly check whether LDAPS is in use and schedule host updates for 8.4 / 9 from the official Citrix channels.

Apply the update quickly — especially where LDAPS is actively used on the management network.

Alterkom helps organisations operate and secure virtualization platforms, including configuration reviews, update planning and management-network protection.