Critical Authentication Bypass in Vates Xen Orchestra xo-server CVE-2026-113610 Under Active Exploitation
Vates Xen Orchestra xo-server versions before 6.9.0 contain a critical authorization bypass in the user.set API (CVE-2026-113610). Remote unauthenticated attackers exploit the endpoint to bypass authentication and obtain administrative privileges on xo-server, enabling arbitrary code execution and full takeover of managed XCP-ng/XenServer nodes. Active exploitation is confirmed in the wild. Vates patched the flaw in xo-server 6.9.0 via advisory VSA-2026-062. Immediate patching and forensic review of exposed instances are required.
Critical VM Escape Vulnerabilities in VMware Workstation and Fusion VMSA-2026-0007
VMSA-2026-0007 addresses critical vulnerabilities in VMware Workstation and Fusion that enable guest-to-host escapes. Attackers with administrative privileges on a guest VM can exploit memory corruption flaws—including heap overflows, Use-After-Free (UAF), and type confusion—within device emulation components such as the SVGA device and USB controllers. Successful exploitation allows arbitrary code execution (ACE) on the underlying host operating system with the privileges of the VMware process. This breaks the fundamental isolation premise of virtualization, facilitating full host compromise, data exfiltration, and lateral movement across the physical network. Immediate updates to patched versions are required to mitigate these high-CVSS risks.