Xen
Xen Orchestra VSA-2026-062: Empty-Object Cookie Auth Bypass Exploited to Take Over XCP-ng Pools
Vates warns that a critical Xen Orchestra auth bypass, triggered by a single crafted cookie, is being exploited to gain admin access and root on managed XCP-ng hosts.