A threat actor has been actively exploiting a critical-severity vulnerability in Xen Orchestra, the web-based backup, management, and disaster recovery solution for XCP-ng and XenServer virtualization environments, according to software maker Vates.
Xen Orchestra functions as an agentless control center across hosts, VMs, storage, and pools. The exploited flaw exists in the REST authentication mechanism, where an authentication token is converted to an empty object and treated as an unfiltered lookup. This causes the first token from the collection to be returned, and if the token has not expired, the provider authenticates the attacker as the token owner.
The vulnerability exposes reusable login token IDs, allowing unauthenticated attackers to bypass authentication entirely and obtain administrator privileges. Vates warns that a Xen Orchestra compromise can lead to arbitrary code execution on managed pools and a full XCP-ng node takeover as root.
The security defect affects Xen Orchestra releases prior to 6.9.2 (stable) and 6.10.1 (latest), as well as the Xen Orchestra Appliance. Vates also disclosed a second vulnerability exploited by the same actor using already-obtained administrator privileges. This flaw permits malicious VM imports that can compromise XCP-ng hosts; a fix is still in development.
The threat actor has operated from the IP address 91.211.251.112:8001 and via the Tor network. No CVE identifiers have been assigned to the defects. Unauthorized access is not logged, but Vates has shared indicators of compromise limited to this campaign and warned that the absence of these IoCs does not confirm the absence of compromise.
The company recommends placing Xen Orchestra instances behind a dedicated network, blocking known malicious IPs and domains, blocking empty tokens via WAF rules, and rotating all potentially compromised credentials. In cases of confirmed compromise, a full reinstallation is advised because cleanup alone cannot guarantee removal of all backdoors.
