Attackers exploit Xen Orchestra flaw to gain administrator access

A critical authentication bypass in Xen Orchestra is being actively exploited and could allow attackers to take over XCP-ng virtualization hosts. According to The Hacker News, developer Vates VMS has issued a warning about the vulnerability, which is tracked as VSA-2026-062 and does not yet have a CVE identifier.

• SecurityWeek reports that the flaw also allows arbitrary code execution as administrator.

Covered by 3 publishers within 23 hours of the first report.

• BleepingComputer: Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers

Reporting3

BC BleepingComputer Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers · Lawrence Abrams 11:17 AM

THN The Hacker News Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access · info@thehackernews.com (The Hacker News) 1:12 PM

SW SecurityWeek Critical Xen Orchestra Flaws Exploited in Attacks · Ionut Arghire 10:42 AM

Related

AT Attackers exploit flaw allowing SSH access to Linux devices November 9

THN Attacker exploits SGLang flaw to access NEAR AI inference server November 10

SW Attackers exploit flaws in Cisco BroadWorks and Openwave software November 11

RTW Attackers exploit authorization flaw in Drupal Commerce Core October 30