# SZB-f71a910c08: BleepingComputer reports critical Xen Orchestra auth bypass exploited in attacks

BleepingComputer reports that a critical authentication bypass in Xen Orchestra is being actively exploited. The report says the flaw could grant administrator privileges and allow takeover of XCP-ng virtualization hosts.

- Type: Early warning
- Kind: Vulnerability
- Vendor: Xen Orchestra
- Product: Xen Orchestra
- Status: Reported, not confirmed
- Sources: 4 distinct
- First seen: 2026-11-10 16:18 UTC

> No statement or filing from Xen Orchestra has reached cve.now yet. Every claim below is quoted from, and linked to, the source that made it.

Written by a model from the sources below. Verify against them.

## What to do

- Update Xen Orchestra to the patched release named in the vendor advisory.
- Review Xen Orchestra administrator accounts and recent logins for unexpected activity.
- Check XCP-ng hosts for signs of unauthorized changes or takeover.
- Restrict access to the Xen Orchestra management interface until patched.
- Update Xen Orchestra to the version fixed in advisory VSA-2026-062
- Review admin accounts and active sessions for unexpected access

## Timeline

- 2026-11-10 16:17 UTC: Made public by BleepingComputer
- 2026-11-10 16:18 UTC: First seen by cve.now

## Evidence (4 sources)

- 2026-11-10 · Press · [BleepingComputer](https://www.bleepingcomputer.com/news/security/critical-xen-orchestra-auth-bypass-flaw-exploited-to-hijack-vm-servers/): “A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts.” (+1 more: [BleepingComputer on Bluesky](https://bsky.app/profile/bleepingcomputer.com/post/3mzxtpcvev42h))
- 2026-11-10 · Social · [Mastodon](https://infosec.exchange/@infonewscyber/117593315954457284): “Une faille critique de contournement de l'authentification dans Xen Orchestra a été exploitée pour détourner des serveurs de machines virtuelles”
- 2026-11-10 · Press · [The Hacker News](https://thehackernews.com/2026/11/hackers-exploit-critical-xen-orchestra.html): “French software company Vates VMS has warned of a critical security vulnerability in Xen Orchestra that it said is being actively exploited in the wild.”
- 2026-11-10 · Social · [Mastodon](https://infosec.exchange/@ssvc/117594199615393103): “This vulnerability is actively exploited by a threat actor operating intially from 91.211.251.112:8001 and ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion:3333 (via Tor) IOC are listed in the advisory.” (+1 more: [Mastodon](https://infosec.exchange/@ssvc/117594210766460413))

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-f71a910c08&body=https%3A%2F%2Fcve.now%2FSZB-f71a910c08%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-f71a910c08

### Has Xen Orchestra confirmed it?

BleepingComputer, Mastodon and The Hacker News report it. No statement from Xen Orchestra has reached cve.now yet.

Source: https://www.bleepingcomputer.com/news/security/critical-xen-orchestra-auth-bypass-flaw-exploited-to-hijack-vm-servers/, https://infosec.exchange/@infonewscyber/117593315954457284, https://thehackernews.com/2026/11/hackers-exploit-critical-xen-orchestra.html, https://infosec.exchange/@ssvc/117594199615393103

### What should Xen Orchestra users do?

Update Xen Orchestra to the patched release named in the vendor advisory. Review Xen Orchestra administrator accounts and recent logins for unexpected activity. Check XCP-ng hosts for signs of unauthorized changes or takeover. Restrict access to the Xen Orchestra management interface until patched. Update Xen Orchestra to the version fixed in advisory VSA-2026-062. Review admin accounts and active sessions for unexpected access.

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/SZB-f71a910c08
Site guide for agents: https://cve.now/llms.txt