XenServer

Citrix and Ivanti Patch 19 Vulnerabilities Including Multiple Critical Flaws

Citrix and Ivanti released patches on Tuesday for 19 vulnerabilities across their products, addressing several critical- and high-severity issues. Ivanti fixed 13 flaws in five products, including two critical vulnerabilities in Cloud Services Application and Endpoint Manager that could enable remote attacks without authentication. The CSA issue tracked as CVE-2026-121683 allows attackers to add or delete trusted certificate entries, while the EPM flaw CVE-2026-121653 permits unauthenticated remote code execution via SQL injection. Citrix addressed six defects in XenServer, including CVE-2026-102705 that could expose the Pool Secret, along with mitigations for AMD CPU vulnerabilities affecting virtual machines. Neither vendor has observed active exploitation of the disclosed issues in the wild.