Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access

Vates VMS has warned of a critical authentication bypass vulnerability in Xen Orchestra, tracked as VSA-2026-062, that it says is being actively exploited in the wild. The flaw lies in how REST authentication handles a parsed authentication token, and successful exploitation can grant an attacker administrator access.