Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers
Teaser from the source
A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts. [...]
This is the RSS-feed teaser. Read the full article at the original source.
Read at BleepingComputerMore on Orchestra
Other advisories
- HighCVE-2026-125323pgEdge Control Plane is a distributed application for managing and orchestrating Postgres databases across multiple hosts. From 0.1.0 to 0.10.1, generated pg…
- Not ratedosv:CVE-2026-125759Nango before 0.71.3 SQL Injection via Orchestrator Task Group Key
- MediumCVE-2026-2700IBM watsonx Orchestrate Cartridge for Cloud Pak for Data: unzureichende Zugriffskontrolle
- MediumCVE-2026-2477IBM watsonx Orchestrate Cartridge for Cloud Pak for Data: fehlende Autorisierung
- MediumCVE-2026-2700IBM watsonx Orchestrate Cartridge for Cloud Pak for Data: unzureichende Zugriffskontrolle
- MediumCVE-2026-2700IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 allows low-privileged users to execute administrative f…
- MediumCVE-2026-2477IBM watsonx Orchestrate Cartridge for Cloud Pak for Data: fehlende Autorisierung
- MediumCVE-2026-2477IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 fails to enforce backend authorization checks, allowing…
Other news entries
- Critical Xen Orchestra Flaws Exploited in AttacksNewsSecurityWeek
- Commvault rolls out an automated recovery mechanism, promising faster restoration of businessNewsCSO Online
- Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin AccessNewsThe Hacker News
- AI used in Aur0ra ransomware testing and executionNewsSophos X-Ops
- PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated NetworkNewsThe Hacker News
- NCSC-2026-0459 [1.00] [M/H] Kwetsbaarheid verholpen in Arista VeloCloud Orchestrator (VCO) on-premisesNewsNCSC-NL
- CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloudNewsThe Hacker News
- Arista VeloCloud Orchestrator: Schwachstelle ermöglicht SQL-Injection und potenziell PrivilegieneskalationVulnerabilityBSI CERT-Bund
ID