Xen Orchestora auth bypass exploited to gain admin access

Tier B · Patch this week – Put it in the sprint

Who’s exposed: Xen Orchestra instances administered by their operators

Tier B because: Exploited in the wild OR public exploit

Reach

Attack

Damage

Fix

Exploited in the wild · Remote, no login · Full takeover

What to do

Review Vates advisory VSA-2026-062 to determine whether your Xen Orchestra instance is affected and what fix is available

The Brief

Attackers are already using this authentication bypass to gain admin access to Xen Orchestra, which manages Xen virtualization infrastructure.

Checklist · 4 of 10 yes

Yes	Hits tech teams	Judgment: Xen Orchestra is a management platform for Xen/XCP-ng hypervisors that IT and ops teams run.
No	Core infrastructure	Judgment: a single virtualization management product, not software nearly every team runs.
No	Popular tool	Judgment: a niche virtualization admin tool rather than mainstream widely used developer tech.
Yes	Exploited in the wild	The Hacker News: Vates VMS said the Xen Orchestra flaw is being actively exploited in the wild.
No	Public exploit	No source says exploit code or a proof-of-concept has been published.
Yes	Remote, no login	The Hacker News: described as an authentication bypass flaw in REST cookie parsing, implying network access without credentials.
Yes	Full takeover	The Hacker News headline: attackers exploit the auth bypass to gain admin access.
No	Secrets exposed	No source reports stolen credentials, tokens, configs, or customer data.
No	Supply chain	No source reports compromised packages, updates, build pipelines, or signing keys.
No	No fix yet	No source says a patch is unavailable; the vendor issued advisory VSA-2026-062 without stating a lack of fix.

First seen 4h ago · 1 source · Full story page · How tiers are decided