Vates VMS Xen Orchestra auth bypass exploited to hijack XCP-ng virtualization hosts
Vates VMS Xen Orchestra users face a critical authentication bypass vulnerability, tracked as VSA-2026-062, that is being actively exploited in the wild. Attackers can gain Admin privileges and take over XCP-ng nodes as root. Update to Xen Orchestra 6.9.2 or 6.10.1 immediately to secure your environment.
2 min