Key facts
- Vates reports that a critical authentication bypass in Xen Orchestra is under active exploitation and can grant administrator rights and permit takeover of XCP-ng virtualization hosts.
- The flaw is tracked as VSA-2026-062 and affects Xen Orchestra and Xen Orchestra Appliance (XOA); no CVE identifier or CVSS score has been assigned yet.
- Attackers who can reach the management interface over the network can bypass authentication with a specially crafted cookie.
- Sending the cookie authenticationToken=j:%7B%7D, which contains an empty JSON object {}, lets attackers retrieve an existing authentication token and log in as its owner without credentials.
Vates said Nov. 10, 2026 that attackers are actively exploiting a serious authentication flaw in Xen Orchestra, a weakness that can give them administrator rights and let them take control of XCP-ng virtualization hosts. BleepingComputer reported the disclosure Nov. 10, 2026.
On Nov. 10, 2026, the company said it tracks the flaw as VSA-2026-062 and that it affects Xen Orchestra and the Xen Orchestra Appliance, also called XOA. The company has not assigned a CVE identifier or a CVSS score to the flaw yet. Vates disclosed the flaw in a security advisory Nov. 10, 2026. The company said the flaw starts in how Xen Orchestra processes authentication tokens that arrive through REST API requests, which let programs exchange data over a network.
Anyone who can reach the management interface over a network can bypass authentication using a specially crafted cookie, Vates said Nov. 10, 2026. Sending authenticationToken=j:%7B%7D, which holds an empty JSON object ({}), lets an attacker retrieve an existing authentication token — a value that proves a user’s identity — and sign in as its owner without credentials. To maintain access, attackers can collect reusable login token IDs at the /rest/v0/users/me/authentication_tokens endpoint. Vates credited Filip Magic and Christoffer Olsen, security researchers at TDC NET Security, with the discovery.
Vates warned Nov. 10, 2026 that an attacker who bypasses authentication can act with administrator privileges, and that compromising Xen Orchestra may lead to arbitrary code execution on managed pools and then to complete takeover of XCP-ng nodes as root. Xen Orchestra is a web-based management tool built by Vates, a French software company, for overseeing XCP-ng virtualization environments including virtual machines, hosts and pools.
On Nov. 10, 2026, the company confirmed that attackers are actively exploiting the flaw and said it shared indicators of compromise, so administrators can spot intrusions. Warning signs include connections to 91.211.251.112:8001 or ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion:3333, a Tor hidden-service address. Other signs include HTTP requests carrying authenticationToken=j:%7B%7D or authenticationToken=j:{}, a virtual machine called pivot2, virtual machines whose serial port uses a file, and the files /etc/cron.d/zz-ustar, /etc/cron.d/zz-ustar2, /.ustar5 and /.ustar6. Vates warns that the attack leaves no log identifiers such as specially crafted cookies, so defenders must detect it through HTTP monitoring instead.
The company says these indicators cover only this known campaign and could differ for other attackers.
Administrators can run commands on XCP-ng hosts to check for unusual virtual machine setups, virtual machines that use a file as a serial port, and harmful files, Vates said Nov. 10, 2026. Organizations that believe they suffered a compromise should change passwords and secrets used inside their virtualization environments.
To fix the flaws, Vates released Xen Orchestra 6.9.1 in its stable channel and 6.10.0 in its latest channel, with updated xo-server packages 5.211.2 and 5.213.1. Administrators should install the update right away. If that is not possible, they should restrict access to dedicated management networks and block traffic from known malicious IP addresses.
Join the discussion