Product
A threat actor is actively exploiting a critical authentication bypass in the Xen Orchestra REST API and a separate zero-day vulnerability to achieve root-level code execution on XCP-ng nodes.