Security AlertCritical
Xen Orchestra flaw is being exploited to hijack VM management servers
Nov 10, 2026 · Summarized by Fundy Tech from BleepingComputer
The 30-second version
A critical Xen Orchestra authentication bypass is being actively exploited. Vates says attackers can gain admin access and take over XCP-ng hosts.
Key points
- The flaw affects Xen Orchestra and Xen Orchestra Appliance.
- Attackers can bypass authentication with a specially crafted cookie.
- Vates says the issue can lead to root takeover of XCP-ng nodes.
Why it matters
If your organization uses Xen Orchestra, attackers could gain administrator access to virtual infrastructure. That puts hosted virtual machines and management systems at risk. Administrators should treat this as an active intrusion risk, not a routine bug.
Who’s affected: Xen Orchestra and XCP-ng virtualization hosts
What to do
- Update Xen Orchestra to the patched releases.
- Restrict access to dedicated management networks.
- Check for the listed suspicious cookies and files.
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.