Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers

By Lawrence Abrams

AI Summary

A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited, granting attackers administrator privileges and enabling full takeover of XCP-ng virtualization hosts. Organizations running Xen Orchestra for VM management should treat this as an emergency patch, as successful exploitation allows arbitrary code execution as admin and lateral movement to underlying hypervisor nodes.

Read full article → https://www.bleepingcomputer.com/news/security/cri…

Relevance score: 84.0/100

# More from November 12

1
Microsoft Patches 1,259 Flaws, Including Exploited Outlook Bug That May Expose NTLMv2 Hashes The Hacker News
2
Who Runs the Ransomware Group Qilin? Krebs on Security
3
Active ScreenConnect attacks breach MSPs, impact dozens of organizations BleepingComputer
4
Microsoft Researchers Show AI Agents Can Be Backdoored by Editing Fewer Than 10 Neurons The Hacker News
5
Cisco BroadWorks and Openwave Flaws Actively Exploited Despite Available Patches The Hacker News
7
Fortinet Patches Nearly 100 Vulnerabilities SecurityWeek
8
Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem The Hacker News
9
eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise The Hacker News
10
Railway Says Stolen Customer AI Keys Led to $740,000 in Estimated Unauthorized Usage Charges The Hacker News