Skip to content
Critical Xen Orchestra Auth Bypass Flaw Exploited for VM Server Takeover

Critical Xen Orchestra Auth Bypass Flaw Exploited for VM Server Takeover

First seen 10 Nov 2026, 17:19 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 10, 2026 at 21:21 UTC
  • •A critical vulnerability in Xen Orchestra allows admin access via authentication bypass.
  • •Attackers exploit the flaw using specially crafted cookies, leading to potential full server takeover.
  • •Immediate patching is recommended; if not possible, restrict access and block malicious IPs.

A critical authentication bypass vulnerability in Xen Orchestra, tracked as VSA-2026-062, is being actively exploited, allowing attackers to gain administrator privileges and potentially take over XCP-ng virtualization hosts. The flaw arises from improper handling of authentication cookies, enabling attackers to bypass authentication and execute arbitrary code on managed pools. Affected systems include Xen Orchestra and the Xen Orchestra Appliance, with no CVE or CVSS score assigned yet. Vates, the developer, has released patched versions 6.9.1 and 6.10.0, urging immediate updates. Indicators of compromise include specific IP addresses and suspicious authentication cookies. Administrators unable to patch should restrict access to management networks and block known malicious IPs. The vulnerability was discovered by security researchers Filip Magic and Christoffer Olsen from TDC NET Security.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 1d ago How this analysis works

Timeline

2026-11-10
Vates issues security advisory
Vates confirms the active exploitation of the authentication bypass vulnerability in Xen Orchestra and provides indicators of compromise.
docs.vates.tech
2026-11-10
Patches released
Vates releases Xen Orchestra versions 6.9.1 and 6.10.0 to address the critical vulnerability.
Bleepingcomputer

More articles in this cluster (10)

Following this threat?

Track Vates in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 3

Common questions

What systems are affected by this vulnerability?
Xen Orchestra and the Xen Orchestra Appliance are affected by the authentication bypass vulnerability.
What should I do if I cannot patch immediately?
Restrict access to Xen Orchestra to dedicated management networks and block the attacker's IP addresses.
Who discovered this vulnerability?
The vulnerability was discovered by security researchers Filip Magic and Christoffer Olsen from TDC NET Security.