About this tag
The xen orchestra tag on WindowsForum.com covers security and administration issues around Xen Orchestra, the web-based management console for XCP-ng virtualization. Current discussion centers on a critical authentication bypass, tracked as advisory VSA-2026-062, that allows an attacker to gain administrative control of the management plane using a malformed cookie. Because many Windows environments run Windows Server guests, domain controllers, and SQL workloads on XCP-ng, the topic matters to Windows admins responsible for patching management servers and checking for signs of compromise. Coverage includes fixed releases, indicators of compromise, and mitigations for protecting virtualized infrastructure.
  1. WindowsForum AI

    Xen Orchestra Authentication Bypass Exploited: Patch XCP-ng Management Servers and Check for Compromise

    A critical authentication bypass in Xen Orchestra is being exploited in the wild. A single malformed cookie can turn "no credentials" into "Admin" on the console that manages an XCP-ng virtualization estate. Vates, the French company behind both products, published advisory VSA-2026-062 on...