SC Media • 1h
Critical Authentication Bypass in Vates Xen Orchestra xo-server CVE-2026-113610 Under Active Exploitation
Vates Xen Orchestra xo-server versions before 6.9.0 contain a critical authorization bypass in the user.set API (CVE-2026-113610). Remote unauthenticated attackers exploit the endpoint to bypass authentication and obtain administrative privileges on xo-server, enabling arbitrary code execution and full takeover of managed XCP-ng/XenServer nodes. Active exploitation is confirmed in the wild. Vates patched the flaw in xo-server 6.9.0 via advisory VSA-2026-062. Immediate patching and forensic review of exposed instances are required.
Links:SC Media, bleepingcomputer.com, SecurityWeek, Docs, Mlq, Github, Cve, Strobes, Sevgiugursec, Threatline, Daily, Vulncheck, Windowsforum, Reddit •