VSA-2026-062

Critical Xen Orchestra Auth Bypass Flaw Exploited to Hijack VM Servers

A critical authentication bypass vulnerability tracked as VSA-2026-062 is actively exploited in attacks against Xen Orchestra, allowing remote attackers to gain administrator privileges and take over XCP-ng virtualization hosts. The flaw affects both Xen Orchestra and the Xen Orchestra Appliance, enabling attackers to bypass authentication by sending a specially crafted cookie containing an empty JSON object. Once logged in, threat actors can retrieve reusable login tokens and perform actions with full Admin rights, potentially leading to arbitrary code execution on managed pools and root-level compromise of XCP-ng nodes. Vates has released patched versions including Xen Orchestra 6.9.1 and 6.10.0 along with updated xo-server packages. Security researchers Filip Magic and Christoffer Olsen of TDC NET Security discovered the issue, and Vates has published detailed indicators of compromise to help detect ongoing campaigns. Administrators are urged to apply updates immediately or restrict access to dedicated management networks.