[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fr13_x5hvEP4xw85EEHek0WKIWsuVi7qMnlCVuDOzsRA":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"e39a9d61-5b64-4f60-a77d-2ca353e7e11e","Critical Xen Orchestra Flaws Exploited in Attacks","critical-xen-orchestra-flaws-exploited-in-attacks-1850dc","The authentication bypass allows attackers to execute arbitrary code as admin and take over XCP-ng nodes. The post Critical Xen Orchestra Flaws Exploited in Attacks appeared first on SecurityWeek.","A critical-severity authentication bypass vulnerability in Xen Orchestra's REST mechanism allows unauthenticated attackers to bypass authentication and gain administrator privileges by exploiting how authentication tokens are processed. The flaw affects versions before 6.9.2 (stable) and 6.10.1 (latest), and has been actively exploited by a threat actor to achieve arbitrary code execution and full XCP-ng node takeover as root. Vates recommends upgrading to patched versions, placing instances behind dedicated networks, rotating compromised credentials, and performing full reinstallation in case of confirmed compromise.","Critical Xen Orchestra authentication bypass exploited in active attacks enabling admin code execution.","https:\u002F\u002Fwww.securityweek.com\u002Fcritical-xen-orchestra-flaws-exploited-in-attacks\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F01\u002FVeeam-backup-cloud-storage.jpeg","2026-11-11T15:42:47+00:00","2026-11-11T16:00:23.350517+00:00",9,[17,20,22,24],{"name":18,"type":19},"Xen Orchestra","product",{"name":21,"type":19},"XCP-ng",{"name":23,"type":19},"XenServer",{"name":25,"type":26},"Vates","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":27,"icon":29,"name":30,"slug":31},null,"Vulnerabilities","vulnerabilities",[33,38],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",[],[25,18,21],{"controls":46,"vendors":134},[47,76,105],{"slug":48,"name":49,"problem":50,"products":51},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":77,"name":78,"problem":79,"products":80},"patch-management","Automated patch management","Known holes get closed in days, not months.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":106,"name":107,"problem":108,"products":109},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",[],{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":145},"critical-xen-orchestra-auth-bypass-leads-to-full-hypervisor-takeover","Critical Xen Orchestra Auth Bypass Leads to Full Hypervisor Takeover","A critical authentication bypass flaw in Xen Orchestra's REST API allowed unauthenticated attackers to manipulate authentication token processing and gain full administrator privileges without valid credentials. This is particularly dangerous because Xen Orchestra manages hypervisor infrastructure, meaning a single exploited instance can result in complete takeover of all hosted virtual machines and XCP-ng nodes. The vulnerability was actively exploited in the wild before many organizations had patched, highlighting the urgency of rapid patch deployment for internet-facing management interfaces. Virtualisation management platforms represent high-value, high-impact targets that demand both timely patching and strict network access controls.",[140,141,142,143,144],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 12: Network Infrastructure Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A01:2021 Broken Access Control","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":146,"OWASP A01:2021 Broken Access Control":147,"NIST SP 800-53 SI-2: Flaw Remediation":148,"CIS Control 12: Network Infrastructure Management (v8)":149,"CIS Control 7: Continuous Vulnerability Management (v8)":150},"This point covers security in acquisition, development, and maintenance including vulnerability handling and disclosure, directly applicable to the need for timely patching of this critical flaw in infrastructure management software.","This vulnerability is a direct instance of broken access control, where improper handling of authentication tokens allowed unauthenticated users to obtain administrator privileges.","SI-2 requires organizations to identify, report, and correct information system flaws in a timely manner, which would have driven rapid patching of this critical authentication bypass before attackers could exploit it.","This control calls for restricting access to network and management interfaces; placing Xen Orchestra behind a dedicated management network would have limited attacker access to the vulnerable REST endpoint.","This control requires organizations to continuously assess and remediate vulnerabilities; applying the available patch for this critical flaw before active exploitation occurred would have directly prevented the compromise."]