On 10 November 2026, Vates VMS warned that Xen Orchestra, the web console for XCP-ng and Xen, is under active attack via VSA-2026-062, an authentication bypass with no CVE in that reporting. The Xen Orchestra hosting risk is one public management page that can put every guest on that pool within an attacker's reach.
