There is a Hazelcast Library Java Deserialization Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.Referenceshttps://support.citrix.com/article/CTX234879
