Skip to main content
cve.nowby Sazabi
← Early warnings
SZB-f71a910c08Early warningVulnerabilityReported, not confirmed

BleepingComputer reports critical Xen Orchestra auth bypass exploited in attacks

BleepingComputer reports that a critical authentication bypass in Xen Orchestra is being actively exploited. The report says the flaw could grant administrator privileges and allow takeover of XCP-ng virtualization hosts.

Written by a model from the sources below. Verify against them.

Sources4Reported, not confirmed
Kind
Vulnerability
Vendor
Xen Orchestra
Product
Xen Orchestra
Status
Reported, not confirmed
First seen

What to do

  • Update Xen Orchestra to the patched release named in the vendor advisory.

  • Review Xen Orchestra administrator accounts and recent logins for unexpected activity.

  • Check XCP-ng hosts for signs of unauthorized changes or takeover.

  • Restrict access to the Xen Orchestra management interface until patched.

  • Update Xen Orchestra to the version fixed in advisory VSA-2026-062

  • Review admin accounts and active sessions for unexpected access

Timeline

  1. Made public by BleepingComputer
  2. First seen by cve.now

Evidence 4

  1. Press
    BleepingComputer
    “A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts.”
    +1 more: BleepingComputer on Bluesky
  2. Social
    Mastodon
    “Une faille critique de contournement de l'authentification dans Xen Orchestra a été exploitée pour détourner des serveurs de machines virtuelles”
  3. Press
    The Hacker News
    “French software company Vates VMS has warned of a critical security vulnerability in Xen Orchestra that it said is being actively exploited in the wild.”
  4. Social
    Mastodon
    “This vulnerability is actively exploited by a threat actor operating intially from 91.211.251.112:8001 and ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion:3333 (via Tor) IOC are listed in the advisory.”
    +1 more: Mastodon

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about SZB-f71a910c08

Has Xen Orchestra confirmed it?

BleepingComputer, Mastodon and The Hacker News report it. No statement from Xen Orchestra has reached cve.now yet.Source: BleepingComputer, Mastodon, The Hacker News, Mastodon

What should Xen Orchestra users do?

Update Xen Orchestra to the patched release named in the vendor advisory. Review Xen Orchestra administrator accounts and recent logins for unexpected activity. Check XCP-ng hosts for signs of unauthorized changes or takeover. Restrict access to the Xen Orchestra management interface until patched. Update Xen Orchestra to the version fixed in advisory VSA-2026-062. Review admin accounts and active sessions for unexpected access.

Sources