# Critical Xen Orchestra Authentication Bypass Vulnerability Under Active Exploitation Vates VMS warns of administrative takeover risk via unpatched REST cookie parsing flaw. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-11-10 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/1f37a32d-25a5-4314-b027-58754c885118 ## Active Exploitation Detected French software firm Vates VMS issued an urgent security alert regarding a critical authentication bypass vulnerability in Xen Orchestra. Tracked as VSA-2026-062, the flaw is currently being exploited in the wild. Attackers are leveraging specific IP addresses and TOR domains to target vulnerable systems, necessitating immediate attention from all system administrators. ## Technical Root Cause The vulnerability stems from improper REST cookie parsing where an authenticationToken input is manipulated into an empty object. This object bypasses standard string requirements, causing the token collection to perform an unfiltered lookup. Consequently, the system authenticates the attacker as the owner of the first unexpired token found within the database. ## Administrative Access Risks Successful exploitation grants attackers full Admin privileges within the Xen Orchestra environment. This level of access allows for arbitrary code execution on managed pools and a complete takeover of XCP-ng nodes with root permissions. The ability to execute commands as root poses a severe risk to the integrity of virtualized infrastructure. ## Patching and Remediation Vates VMS has released security updates to address this critical flaw. Users should upgrade to Xen Orchestra version 6.9.1 or 6.10.0 for stable and latest channels respectively. Additionally, xo-server versions 5.211.2 and 5.213.1 contain the necessary fixes. Administrators unable to patch immediately should implement the specific mitigations provided by the vendor. ## Discovery and Reporting The security vulnerability was identified and reported by independent researchers Filip Magic, known as @mad31k, and Christoffer Olsen from TDC NET Security. Their discovery highlights the importance of rigorous security auditing in management software. The vendor credited these researchers for their contribution to securing the Xen Orchestra platform against potential unauthorized access. ## Uncertainty Regarding Timeline It remains unclear exactly when the malicious activity began or if the vulnerability was exploited as a zero-day before its public disclosure. Vates VMS has provided indicators of compromise to help organizations detect potential breaches. Security teams are urged to review logs for unauthorized access patterns matching the identified attack vectors. ## Broader Infrastructure Impact Xen Orchestra serves as a management interface for XCP-ng, making this vulnerability particularly dangerous for enterprise environments relying on centralized virtualization control. A full node takeover allows attackers to compromise all hosted virtual machines, steal sensitive data, or disrupt business operations. The scope of potential damage extends across entire server clusters. ## Security Operations Strategy This incident underscores the necessity of maintaining visibility into machine and AI identities within a Security Operations Center. Organizations must assess their threat readiness and strengthen their attack surface visibility to mitigate emerging risks. Proactive monitoring and rapid incident response remain the primary defenses against sophisticated authentication bypass attacks in virtualized environments. ## Sources covering this story - https://thehackernews.com/2026/11/hackers-exploit-critical-xen-orchestra.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._