Vulnerabilities · 15h ago
On day two, CSIRT-ITA added mitigation and detection guidance for two actively exploited flaws in Vates’ Xen Orchestra and Xen Orchestra Appliance. The affected Xen Orchestra releases are 6.9.x before 6.9.2 and 6.10.x before 6.10.1.
One malformed login cookie becomes an empty search filter, so Xen Orchestra returns its first valid user token and signs the attacker in as its owner—potentially an administrator. That access can run arbitrary code across managed pools and compromise XCP-ng nodes. A separate flaw lets users with limited permissions import a crafted Xen virtual appliance (XVA) file; Xen Orchestra passes its unsafe settings to the Xen API (XAPI) with pool-admin privileges, allowing the import to cross those permissions and reach the host.
If Xen Orchestra manages production virtualization, the console is only one boundary: either path can leave compromised systems inside pools or XCP-ng nodes, so restoring the manager alone may not restore trust in its managed estate.
6 sources covering this story
Vates: rilevato sfruttamento in rete di vulnerabilità in Xen Orchestra
Vates ha rilevato lo sfruttamento in rete di vulnerabilità che interessano Xen Orchestra e Xen Orchestra Appliance, soluzioni per la gestione centralizzata di infrastrutture di virtualizzazione basate su XCP-ng e Xen.
Critical Xen Orchestra Flaws Exploited in Attacks
A critical authentication bypass allows attackers to execute arbitrary code as admin and take over XCP-ng nodes.
Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access
Hackers are exploiting a critical Xen Orchestra authentication bypass that can grant admin access and lead to XCP-ng node takeover.
Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers
A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts.
X.Org patches eight server vulnerabilities a month after fixing 12 others - Help Net Security
X.Org server vulnerabilities fixed: eight flaws, one triggered by a malicious monitor. Update to xorg-server 21.1.26 and xwayland 24.1.15.
Zero Day Initiative Advisories
X.Org Server Font Alias Resolution Heap-based Buffer Overflow Privilege Escalation Vulnerability
X.Org Server Font Alias Resolution Heap-based Buffer Overflow Privilege Escalation Vulnerability Vulnerability Details This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server.
Zero Day Initiative Advisories
X.Org Server XkbResizeKeySyms Integer Overflow Privilege Escalation Vulnerability
X.Org Server XkbResizeKeySyms Integer Overflow Privilege Escalation Vulnerability Vulnerability Details This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server.
Zero Day Initiative Advisories
X.Org Server libXrender RenderQueryPictFormats Reply Heap-based Buffer Overflow Remote Code Execution Vulnerability Vulnerability Details This vulnerability allows remote attackers to execute arbitrary code on affected installations of X.Org Server.
Zero Day Initiative Advisories
X.Org Server libX11 XkbGetMap Reply Heap-based Buffer Overflow Remote Code Execution Vulnerability
X.Org Server libX11 XkbGetMap Reply Heap-based Buffer Overflow Remote Code Execution Vulnerability Vulnerability Details This vulnerability allows remote attackers to execute arbitrary code on affected installations of X.Org Server.
Zero Day Initiative Advisories
X.Org Server ProcDRI2GetBuffers Heap-based Buffer Overflow Privilege Escalation Vulnerability
X.Org Server ProcDRI2GetBuffers Heap-based Buffer Overflow Privilege Escalation Vulnerability Vulnerability Details This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server.
Part of the PlainSec briefing for 2026-11-12