Critical Xen Orchestra flaws exploited to take over XCP-ng nodes

Tier B · Patch this week – Put it in the sprint

Who’s exposed: XCP-ng nodes managed through Xen Orchestra

Tier B because: Exploited in the wild OR public exploit

Reach

Attack

Damage

Fix

Exploited in the wild · Full takeover

The Brief

A critical authentication bypass in Xen Orchestra allows attackers to execute arbitrary code as admin.
The flaws are reported to be exploited in attacks.
Attackers can take over XCP-ng nodes managed through Xen Orchestra.

Xen Orchestra manages XCP-ng hypervisors, so a compromise can give attackers admin control over the virtualization nodes that host workloads.

Checklist · 3 of 10 yes

Yes	Hits tech teams	Xen Orchestra manages XCP-ng virtualization hosts that IT and ops teams run.
No	Core infrastructure	A single virtualization management product, not software nearly every team runs.
No	Popular tool	Xen Orchestra is a niche virtualization management tool, not a mainstream developer tool.
Yes	Exploited in the wild	SecurityWeek: headline and summary report the flaws are exploited in attacks.
No	Public exploit	SecurityWeek does not say exploit code or a proof-of-concept is published.
No	Remote, no login	SecurityWeek mentions an authentication bypass but does not explicitly state network or unauthenticated access.
Yes	Full takeover	SecurityWeek: attackers can execute arbitrary code as admin and take over XCP-ng nodes.
No	Secrets exposed	SecurityWeek does not report stolen credentials, keys, configs or data.
No	Supply chain	SecurityWeek describes an authentication bypass, not a compromised package, update or pipeline.
No	No fix yet	SecurityWeek does not state whether a patched version is available.

First seen 2h ago · 1 source · Full story page · How tiers are decided