Critical Xen Orchestra authentication bypass is being actively exploited

# Critical Xen Orchestra authentication bypass is being actively exploited

https://gcdradar.vercel.app/incidents/critical-xen-orchestra-authentication-bypass-is-being-active · AIR-2026-1853 · live

- Lane: Patch now
- Severity: 3 (Confirmed exploitation): Active exploitation in the wild confirmed.
- Fix status: Fix status unknown
- First reported: 2026-11-10
- AI role: No AI role
- Products: Xen Orchestra, Xen Orchestra Appliance

## Summary

An authentication bypass flaw in Xen Orchestra and Xen Orchestra Appliance is actively exploited in the wild. Vates has issued an advisory urging immediate action.

## What to do

Check the vendor advisory for available updates and apply patches immediately.

## Latest updates

- 2026-11-10: Vendor details root cause involving REST cookie parsing vulnerability tracked as VSA-2026-062 (https://thehackernews.com/2026/11/hackers-exploit-critical-xen-orchestra.html)
- 2026-11-10: Critical Xen Orchestra authentication bypass is being actively exploited (https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062)

## Sources

- 2026-11-10 docs.vates.tech: Critical Xen Orchestra authentication bypass is being actively exploited https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062
- 2026-11-10 BleepingComputer: Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers https://bleepingcomputer.com/news/security/critical-xen-orchestra-auth-bypass-flaw-exploited-to-hijack-vm-servers
- 2026-11-10 The Hacker News: Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access https://thehackernews.com/2026/11/hackers-exploit-critical-xen-orchestra.html
- 2026-11-11 SecurityWeek: Critical Xen Orchestra Flaws Exploited in Attacks https://securityweek.com/critical-xen-orchestra-flaws-exploited-in-attacks

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.