> TritonInfoSec News
Home / Nov 11, 2026 / Story
0
#7 The Hacker News general November 10, 2026 at 18:12 UTC

Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access

By [email protected] (The Hacker News)

AI Summary

A critical authentication bypass vulnerability (VSA-2026-062) in Xen Orchestra — tracked by vendor Vates VMS — is being actively exploited in the wild, allowing attackers to gain administrator access to XCP-ng virtualization hosts. The flaw stems from improper REST cookie parsing where an authenticationToken is converted to an empty object, bypassing authentication entirely. Exploitation could grant full control over VM infrastructure, making immediate patching urgent for any Xen Orchestra deployment.

Read full article → https://thehackernews.com/2026/11/hackers-exploit-…

Relevance score: 84.0/100

# More from November 11

  1. 1
    Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day BleepingComputer
  2. 2
    France Blames Iran for Sabotage Attack on Refrigeration Controllers at About 700 Retail Sites The Hacker News
  3. 3
    N-able Takes N-central Cloud Offline After Researcher Discloses 33 Zero-Days with PoC Exploits The Hacker News
  4. 4
    Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers The Hacker News
  5. 5
    New OpenSSH Vulnerability Schneier on Security
  6. 6
    SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution The Hacker News
  7. 8
    Google Issues Chrome Security Update for Eighth Actively Exploited Zero-Day of 2026 The Hacker News
  8. 9
    Japanese furniture giant Nitori says hackers stole 37.6M customer records BleepingComputer
  9. 10
    Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones The Hacker News