From Dev.to
Xen Orchestra VSA-2026-062: An Empty Cookie That Hands Attackers Admin on Your Virtualization Plane
On November 10, 2026, Vates published VSA-2026-062, a Critical authentication bypass in Xen Orchestra (XO) and the Xen Orchestra Appliance (XOA), and said it is being actively exploited. There is no C...