Critical Vulnerability in Xen Orchestra Actively Exploited
A critical vulnerability in Xen Orchestra allows attackers to bypass authentication and gain administrator privileges. The flaw is actively exploited, prompting Vates to release patched versions.
OffSet7 Newsroom · Reviewed by an OffSet7 analyst · AI-assisted
What happened
A critical authentication bypass vulnerability was discovered in Xen Orchestra.
Who is affected
Xen Orchestra versions before 6.9.2 and 6.10.1.
Exploited
Confirmed exploitation reported.
What to do
Update to Xen Orchestra versions 6.9.1 (stable) or 6.10.0 (latest).
A critical authentication bypass vulnerability has been discovered in Xen Orchestra, affecting versions prior to 6.9.2 and 6.10.1. This flaw allows remote attackers to bypass authentication and gain administrator privileges.
The vulnerability is exploited by sending a specially crafted cookie that is parsed into an empty JSON object. This enables attackers to retrieve existing authentication tokens, potentially leading to arbitrary code execution on managed pools and a full takeover of an XCP-ng node as root.
The vulnerability is actively exploited by a threat actor using the IP address 91.211.251.112 and a Tor onion address. Indicators of compromise include HTTP requests with the empty-object cookie and unusual files such as /etc/cron.d/zz-ustar.
Vates has responded by releasing patched versions of Xen Orchestra: 6.9.1 (stable) and 6.10.0 (latest). The vulnerability is tracked as VSA-2026-062, though no CVE identifier or CVSS score has been assigned yet.
The vulnerability was discovered by Filip Magic and Christoffer Olsen from TDC NET Security. Vates has confirmed the active exploitation of this security flaw.
