Actively Exploited Xen Orchestra Flaw Enables Admin Access and Host Takeover
Summary
Vates says attackers are exploiting a Xen Orchestra authentication bypass that can grant admin privileges and enable XCP-ng host takeover. Fixed releases are available; Vates warns detection requires HTTP monitoring.
Key points
- Vates says the flaw, tracked as VSA-2026-062, is actively exploited; no CVE or CVSS score has been assigned.
- A crafted authentication cookie can bypass login and grant admin privileges; the flaw affects Xen Orchestra and Xen Orchestra Appliance.
- Vates warns that compromise could lead to arbitrary code execution on managed pools and root-level takeover of XCP-ng nodes.
- Fixed releases include Xen Orchestra 6.9.1 and 6.10.0, with patched xo-server packages 5.211.2 and 5.213.1.
- Vates says the crafted-cookie activity may not appear as an identifier in logs and recommends HTTP monitoring; administrators should update or restrict management access to dedicated networks.
- Reported indicators include 91.211.251.112:8001, ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid[.]onion:3333, a VM named pivot2, and suspicious files under /etc/cron.d.
Article Details
- Vulnerability Types
- Authentication bypass
- Severity
- Critical
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Restrict Xen Orchestra access to dedicated management networks.
- Block known malicious IP addresses.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 91[.]211[.]251[.]112 | IP address identified by Vates as attacker infrastructure associated with the known attack campaign. |
People
Vendors
Products
XCP-ngA critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts.Xen OrchestraCritical Xen Orchestra auth bypass flaw exploited to hijack VM serversXen Orchestra Appliance (XOA)The vulnerability, tracked as VSA-2026-062, affects Xen Orchestra and the Xen Orchestra Appliance (XOA) and allows remote attackers with network access to the management interface to bypass authentication using a