Attackers exploit a critical Xen Orchestra authentication bypass to take over virtualization servers

Vates rates the flaw, tracked as VSA-2026-062, critical and says it is being actively exploited; no CVE or CVSS score has been assigned yet [1] .

Fixed releases are Xen Orchestra 6.9.1 (stable) and 6.10.0 (latest), with xo-server 5.211.2 and 5.213.1 [1] .

Attackers are exploiting a critical authentication bypass in Xen Orchestra, the web management console for Xen and XCP-ng virtualization, to gain admin access and take over the servers it manages, developer Vates warned on Tuesday [1] . The company published fixes in Xen Orchestra 6.9.1 on its stable channel and 6.10.0 on its latest channel, and told customers to update as soon as possible [1] .

The bug, tracked as VSA-2026-062, sits in how Xen Orchestra handles authentication cookies. A cookie value of authenticationToken=j:{} is parsed into an empty object, which the token lookup treats as an unfiltered query, so it returns the first stored token and logs the attacker in as that token's owner without a password [1] . Vates says the attacker then acts with admin privileges, which "can lead to arbitrary code execution on managed pools" and full takeover of an XCP-ng node as root [1] [2] . The Xen Orchestra Appliance is also affected [1] .

Vates tied the activity it has seen to an actor using the IP address 91.211.251.112 on port 8001 and a Tor onion address on port 3333 [1] . Its indicators include HTTP requests carrying the empty-object cookie, a virtual machine named pivot2 , VMs configured with an hvm_serial: file parameter, serial file: entries in /var/log/xensource.log , and the files /etc/cron.d/zz-ustar , /etc/cron.d/zz-ustar2 , /.ustar5 , /.ustar6 and /etc/ld.so.preload [1] . BleepingComputer notes that the login itself leaves no identifying entries in Xen Orchestra's logs, so spotting it requires HTTP-level monitoring, and that the indicators apply to this campaign only [2] .

Customers who cannot patch immediately should keep Xen Orchestra off the internet on a dedicated management network, block the attacker's IP and Tor traffic, and add a web application firewall or reverse-proxy rule for the empty-token patterns, though Vates cautions that such rules can be bypassed [1] . Anyone who suspects compromise should rotate every password and secret the platform uses [1] . Vates credited Filip Magic and Christoffer Olsen of TDC NET Security with the report [1] . Neither source gives a count of exposed or compromised servers.