# Critical Xen Orchestra Flaws Exploited in Attacks

Source: [SecurityWeek](https://www.securityweek.com/critical-xen-orchestra-flaws-exploited-in-attacks/) · 2026-11-11 · Security
Page: https://themorning.dev/story/critical-xen-orchestra-flaws-exploited-in-attacks-d62ab9694fcc03e3
Kind: security · Impact: high

## In brief

- A critical authentication bypass in Xen Orchestra allows attackers to execute arbitrary code as admin.
- The flaws are reported to be exploited in attacks.
- Attackers can take over XCP-ng nodes managed through Xen Orchestra.

## Why it matters

Xen Orchestra manages XCP-ng hypervisors, so a compromise can give attackers admin control over the virtualization nodes that host workloads.

## Timeline

- 2026-11-11: Exploitation of the flaws in attacks reported by SecurityWeek

## Coverage

- [Critical Xen Orchestra Flaws Exploited in Attacks](https://www.securityweek.com/critical-xen-orchestra-flaws-exploited-in-attacks/) — SecurityWeek, 2026-11-11

Tags: security, virtualization, xen-orchestra, xcp-ng, authentication-bypass

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev