Xen Orchestra auth bypass exploited to root XCP-ng hosts (VSA-2026-062)
A crafted cookie bypasses authentication in Xen Orchestra, granting admin and code execution on managed pools. Vates confirms active exploitation. Patch now.
A crafted cookie bypasses authentication in Xen Orchestra, granting admin and code execution on managed pools. Vates confirms active exploitation. Patch now.