Critical Xen Orchestra Authentication Bypass Vulnerability Under Active Exploitation
Vates VMS warns of administrative takeover risk via unpatched REST cookie parsing flaw.
1Active Exploitation Detected
French software firm Vates VMS issued an urgent security alert regarding a critical authentication bypass vulnerability in Xen Orchestra. Tracked as VSA-2026-062, the flaw is currently being exploited in the wild. Attackers are leveraging specific IP addresses and TOR domains to target vulnerable systems, necessitating immediate attention from all system administrators.
2Technical Root Cause
The vulnerability stems from improper REST cookie parsing where an authenticationToken input is manipulated into an empty object. This object bypasses standard string requirements, causing the token collection to perform an unfiltered lookup. Consequently, the system authenticates the attacker as the owner of the first unexpired token found within the database.
3Administrative Access Risks
Successful exploitation grants attackers full Admin privileges within the Xen Orchestra environment. This level of access allows for arbitrary code execution on managed pools and a complete takeover of XCP-ng nodes with root permissions. The ability to execute commands as root poses a severe risk to the integrity of virtualized infrastructure.
4Patching and Remediation
Vates VMS has released security updates to address this critical flaw. Users should upgrade to Xen Orchestra version 6.9.1 or 6.10.0 for stable and latest channels respectively. Additionally, xo-server versions 5.211.2 and 5.213.1 contain the necessary fixes. Administrators unable to patch immediately should implement the specific mitigations provided by the vendor.
5Discovery and Reporting
The security vulnerability was identified and reported by independent researchers Filip Magic, known as @mad31k, and Christoffer Olsen from TDC NET Security. Their discovery highlights the importance of rigorous security auditing in management software. The vendor credited these researchers for their contribution to securing the Xen Orchestra platform against potential unauthorized access.
6Uncertainty Regarding Timeline
It remains unclear exactly when the malicious activity began or if the vulnerability was exploited as a zero-day before its public disclosure. Vates VMS has provided indicators of compromise to help organizations detect potential breaches. Security teams are urged to review logs for unauthorized access patterns matching the identified attack vectors.
7Broader Infrastructure Impact
Xen Orchestra serves as a management interface for XCP-ng, making this vulnerability particularly dangerous for enterprise environments relying on centralized virtualization control. A full node takeover allows attackers to compromise all hosted virtual machines, steal sensitive data, or disrupt business operations. The scope of potential damage extends across entire server clusters.
8Security Operations Strategy
This incident underscores the necessity of maintaining visibility into machine and AI identities within a Security Operations Center. Organizations must assess their threat readiness and strengthen their attack surface visibility to mitigate emerging risks. Proactive monitoring and rapid incident response remain the primary defenses against sophisticated authentication bypass attacks in virtualized environments.