Hackers Exploit Xen Orchestra Auth Flaw

Security researchers Filip Magic and Christoffer Olsen discovered a critical authentication bypass flaw in Xen Orchestra, tracked as VSA-2026-062. The vulnerability allows remote attackers to hijack VM servers by sending a specially crafted cookie. Vates released patched versions 6.9.1 and 6.10.0 to fix the issue. Administrators must install updates immediately or restrict network access to prevent full XCP-ng node takeover.