Skip to content
securitytabs

Covered by 2 outlets — first reported by BleepingComputer, Nov 10, 16:17 UTC

Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers

Summary

A critical authentication bypass flaw in Xen Orchestra, a management tool for XCP-ng virtualization hosts, is being exploited in attacks, allowing intruders to gain administrator privileges and take over the hosts. SecurityWeek reports the flaws let attackers run arbitrary code as an administrator. The coverage reviewed does not give a CVE identifier or details of who is behind the attacks.

AI summary by the SecurityTabs newsroom, checked against BleepingComputer, SecurityWeek. Read the outlets below for the full story.

Continue reading

2 outlets, in the order they reported it.

  1. BleepingComputerFirst report

    Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers

    A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts.

    Read at BleepingComputer Details

  2. SecurityWeek

    Critical Xen Orchestra Flaws Exploited in Attacks

    A critical authentication bypass allows attackers to execute arbitrary code as admin and take over XCP-ng nodes.

    Read at SecurityWeek Details

Explained

The technology and terms in this story. Learn more