Attackers are exploiting a critical authentication bypass in Xen Orchestra to gain administrator-level access, execute arbitrary code, and take over XCP-ng virtualization nodes or VM servers. Multiple outlets report that the flaw is being actively exploited “in the wild,” with consequences including host takeover.
The reports focus on how the vulnerability undermines authentication. SecurityWeek and Bleeping Computer describe the impact in terms of remote execution and admin control over XCP-ng components, while The Hacker News adds that French software company Vates VMS has issued an alert. The Hacker News also notes that the issue is tracked under an internal identifier and that it appears to involve how REST cookie parsing handles an authentication token, passing an object in a way that breaks authentication.
Across coverage, the shared core is the active exploitation and the privilege-escalation potential. Differences are mainly in how outlets frame technical cause versus reported operational risk and which vendor details they emphasize.
