xen-orchestra vulnerabilities

1 known vulnerability in xen-orchestra from Vatesfr. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  xen-orchestra: Improperly Controlled Modification of Object Prototype Attributes

  CVE-2026-110111Oct 13, 2026Vatesfr

  Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at