Science & Tech · Cybersecurity · 3 hrs ago
Attackers exploit Xen Orchestra flaw to gain admin access
Vates, a French software company, says attackers are actively exploiting a flaw in Xen Orchestra, its platform for managing XCP-ng virtual machines and hosts.
The flaw lets attackers with network access to the management interface bypass login using a specially crafted cookie.
They can gain administrator privileges and reusable login tokens without valid credentials.
Vates warns that a successful attack could lead to code execution on managed systems and a full XCP-ng host takeover.
The company has released fixed versions of Xen Orchestra and its server software, and advises administrators to install them.
If they cannot update immediately, administrators should restrict access to management networks and block known malicious connections.
Vates says organizations that find signs of compromise should rotate passwords and other secrets used by their virtualization environments.
Vates says attackers are actively exploiting a critical authentication bypass flaw in Xen Orchestra.
The flaw, tracked as VSA-2026-062, can let remote attackers gain administrator privileges and take over XCP-ng hosts as root.
Attackers can exploit the flaw by sending a specially crafted cookie containing an empty JSON object.
Vates has released fixed versions of Xen Orchestra and xo-server.
Administrators are advised to install updates, monitor HTTP traffic and rotate passwords and secrets if they suspect a compromise.
- Who
- Attackers are exploiting the flaw; Vates says it has observed activity from a threat actor.
- What
- A Xen Orchestra authentication bypass can allow attackers to gain admin access and take over managed XCP-ng hosts.
- When
- Vates says the flaw is being actively exploited. The start of the activity is unclear.
- Where
- Xen Orchestra and Xen Orchestra Appliance management interfaces used for XCP-ng virtualization environments.
- Why
- The flaw lets a specially crafted cookie bypass authentication and retrieve a reusable login token.
This story does not have two clearly opposing sides.
This story does not have a timeline yet.
- Vulnerability
- VSA-2026-062
- Patched Xen Orchestra versions
- 6.9.1 and 6.10.0
- Patched xo-server versions
- 5.211.2 and 5.213.1
- Reported attacker IP address
- 91.211.251.112:8001
- Reported suspicious virtual machine
- pivot2
- Researchers credited with discovery
- Filip Magic and Christoffer Olsen of TDC NET Security
3 sources
What people are saying
REST cookie parsing turns authenticationToken=j:%7B%7D into {}
An adversary can bypass authentication and perform actions with 'Admin' privilege. Xen Orchestra compromise can lead to arbitrary code execution on managed pools and a full XCP-ng node takeover as root