VSA-2026-062: Empty-object login token
Classification: Critical, Solution: Official Fix, Exploit Maturity: High, CVSSv3.1: None, CVEs: , Summary: A vulnerability was discovered in Xen Orchestra that is part of the Xen Orchestra Appliance. We classify the impact as Critical. For details on how we assign severity levels, see our Severity Levels Explained page. This vulnerability is actively exploited by a threat actor operating intially from 91.211.251.112:8001 and ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion:3333 (via…