Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers

A critical authentication bypass vulnerability in Xen Orchestra allowed attackers to forge specially crafted cookies and trick the platform into issuing administrator-level authentication tokens, granting full control over XCP-ng virtualization hosts. This type of flaw is particularly dangerous in hypervisor management platforms because compromising a single control plane can expose every virtual machine running beneath it. The vulnerability was actively exploited before many organizations applied the available patches, highlighting the need for rapid response to critical flaws in infrastructure management software. Virtualization hosts represent high-value targets — a successful takeover can result in mass data exfiltration, ransomware deployment across all VMs, or complete operational disruption.