Security · High impactFan score 47 · Tier B
Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access
The Hacker News ·
The Brief
- Vates VMS warned of a critical authentication bypass in Xen Orchestra.
- Vates says the flaw is being actively exploited in the wild.
- The flaw is tracked as VSA-2026-062 and does not yet have a CVE identifier.
Why it matters
Attackers are already using this authentication bypass to gain admin access to Xen Orchestra, which manages Xen virtualization infrastructure.
Who’s affected
- Xen Orchestra administrators
What to do
- Review Vates advisory VSA-2026-062 to determine whether your Xen Orchestra instance is affected and what fix is available
- #xen-orchestra
- #authentication-bypass
- #vulnerability
- #virtualization
- #exploited-in-the-wild
French software company Vates VMS has warned of a critical security vulnerability in Xen Orchestra that it said is being actively exploited in the wild. The authentication bypass flaw, which does not yet have a CVE identifier, is tracked as VSA-2026-062. "REST cookie parsing…