Skip to main content
Apexward Pulse
Type Vulnerability

Auth bypass

Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers

1 source

At a glance

Low
30-day window, from the last update
Evidence-weighted, not popularity
Why Low

Low rather than Medium: UK relevance is 40 of 100, little UK-specific signal so far.

Briefing

There is no written leader briefing for this story yet. The summary below says what is known so far.

Next steps

  1. Confirm whether this affects systems or suppliers in your estate

Summary

  • A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualisation hosts.

Read the original reportBleepingComputer(opens in a new tab)

Pulse

Last change 40m ago · Next recheck 11 Nov 2026, 16:22 UK time

  1. Story10 Nov 2026, 16:22 UK time · 40m ago

    Linked reporting from BleepingComputer (independent original reporting).

    Read source (BleepingComputer)

1 entry so far. The timeline chart appears once this story has more history.

Sources

How we know

Statements extracted from sources. Higher confidence means stronger corroboration.

  • ClaimedHeadline60% confidence

    Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers

  • ProbableSummary fact75% confidence

    A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts.