[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flMppyYg7Dnj-n-ukJ-p_vmZn6koh0H135BNFR3SqOBg":3},{"article":4,"iocs":44,"watch_terms":62,"solutions":63,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":6,"url":10,"image_url":11,"published_at":12,"ingested_at":13,"relevance_score":14,"entities":15,"category_id":26,"category":27,"article_tags":31},"a8aec1de-b33f-466f-a905-abfc6281edc6","Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers","critical-xen-orchestra-auth-bypass-flaw-exploited-to-hijack-vm-servers-f71a91","A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts. [...]","A critical authentication bypass vulnerability (VSA-2026-062) in Xen Orchestra is being actively exploited, allowing attackers to gain administrator privileges and take over XCP-ng virtualization hosts. The flaw involves specially crafted cookies that trick the platform into retrieving authentication tokens. Vates has released patched versions Xen Orchestra 6.9.1 and 6.10.0, along with xo-server packages 5.211.2 and 5.213.1.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcritical-xen-orchestra-auth-bypass-flaw-exploited-to-hijack-vm-servers\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F11\u002F10\u002Fxen-orchestrator-logo.jpg","2026-11-10T16:17:16+00:00","2026-11-10T17:00:23.484527+00:00",9,[16,19,21,23],{"name":17,"type":18},"Xen Orchestra","product",{"name":20,"type":18},"Xen Orchestra Appliance",{"name":22,"type":18},"XCP-ng",{"name":24,"type":25},"Vates","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":28,"name":29,"slug":30},null,"Vulnerabilities","vulnerabilities",[32,34,39],{"category":33},{"id":26,"icon":28,"name":29,"slug":30},{"category":35},{"id":36,"icon":28,"name":37,"slug":38},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45,49,53,57,59],{"type":46,"value":47,"context":48},"ip","91.211.251.112","Attacker's infrastructure IP address",{"type":50,"value":51,"context":52},"domain","ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion","Attacker's infrastructure Tor domain",{"type":54,"value":55,"context":56},"url","http:\u002F\u002F91.211.251.112:8001","Attacker's infrastructure URL",{"type":54,"value":58,"context":56},"http:\u002F\u002Fustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion:3333",{"type":38,"value":60,"context":61},"pivot2","Suspicious virtual machine name",[24,17,20],{"controls":64,"vendors":151},[65,94,123],{"slug":66,"name":67,"problem":68,"products":69},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":95,"name":96,"problem":97,"products":98},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":124,"name":125,"problem":126,"products":127},"patch-management","Automated patch management","Known holes get closed in days, not months.",[128,136,144],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":124,"product_name":148,"url":149,"description":150},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",[],{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":162},"auth-bypass-in-xen-orchestra-lets-attackers-hijack-vm-hosts","Auth Bypass in Xen Orchestra Lets Attackers Hijack VM Hosts","A critical authentication bypass vulnerability in Xen Orchestra allowed attackers to forge specially crafted cookies and trick the platform into issuing administrator-level authentication tokens, granting full control over XCP-ng virtualization hosts. This type of flaw is particularly dangerous in hypervisor management platforms because compromising a single control plane can expose every virtual machine running beneath it. The vulnerability was actively exploited before many organizations applied the available patches, highlighting the need for rapid response to critical flaws in infrastructure management software. Virtualization hosts represent high-value targets — a successful takeover can result in mass data exfiltration, ransomware deployment across all VMs, or complete operational disruption.",[157,158,159,160,161],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 12: Network Infrastructure Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A07:2021 Identification and Authentication Failures","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":163,"NIST SP 800-53 SI-2: Flaw Remediation":164,"CIS Control 12: Network Infrastructure Management (v8)":165,"CIS Control 7: Continuous Vulnerability Management (v8)":166,"OWASP A07:2021 Identification and Authentication Failures":167},"NIS2 Article 21(2)(e) mandates security in acquisition, development and maintenance including vulnerability handling, requiring operators of critical infrastructure platforms like Xen Orchestra to have processes for rapid patch deployment.","SI-2 requires organizations to identify, report, and correct information system flaws in a timely manner, which directly applies to the delayed patching that allowed active exploitation of this known vulnerability.","CIS Control 12 calls for restricting access to network and management interfaces; limiting Xen Orchestra exposure to trusted networks would have prevented unauthenticated attackers from reaching the vulnerable endpoint.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities; applying the Xen Orchestra patches promptly under a formal process would have closed this flaw before active exploitation occurred.","This vulnerability is a textbook authentication failure where crafted cookies bypassed identity verification, the exact class of weakness OWASP A07 addresses in web and API authentication mechanisms."]