Xen Orchestra Auth Bypass Exploited to Take Over XCP-ng
French vendor Vates warned that a critical flaw in Xen Orchestra, the management tool for XCP-ng virtualization, is under active exploitation. A crafted cookie bypasses authentication, granting admin rights and root control of hosts.
⚡ Why it matters
Whoever controls the virtualization manager controls every server it runs at once, a favorite target for ransomware gangs.
The flaw has no CVE yet and is tracked by Vates as VSA-2026-062. The cookie authenticationToken=j:{} is parsed into an empty object {}, which the token store treats as an unfiltered lookup and returns the first token, logging the attacker in as its owner. From there the attacker obtains reusable login tokens, acts as Admin and can run code on managed pools and take over an XCP-ng node as root.
Vates later said attackers chain it with a second flaw, VSA-2026-063, which lets a low-privileged user import a malicious VM (XVA file) with crafted keys and compromise an XCP-ng host.
Indicators of compromise
- IP
91.211.251[.]112:8001, flagged as a RedLine Stealer C2, plus a Tor domain. - HTTP requests containing
authenticationToken=j:%7B%7D. - A running VM named
pivot2or VMs configured withhvm_serial: file. - Files such as
/etc/cron.d/zz-ustarand/.ustar5.
What to do
- Update Xen Orchestra to 6.9.1 (stable) or 6.10.0 (latest), or xo-server to 5.211.2 or 5.213.1.
- Never expose Xen Orchestra to the internet.
- If you cannot patch now, block the empty token in a WAF or reverse proxy and block the attacker's addresses.
- If you find IoCs, rotate all passwords and secrets.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
FBI Warns Artex AI Tool Automates Hacks at Machine Speed
The FBI issued a flash alert about Artex, an open-source pentesting platform that plugs any LLM into AI agents that run attack stages automatically. Some intrusions reached privileged access in under three hours.
Cisco BroadWorks and Openwave Flaws Exploited, Added to KEV
On Tuesday, November 10, CISA listed two flaws, one in Cisco BroadWorks and one in Openwave Messaging Webtop Media Transcoder, in its Known Exploited Vulnerabilities (KEV) catalog, even though fixes have been out for months.
OpenSSH Flaw Exploited on Alpine: CISA Adds 4 KEV Bugs
On November 9, CISA added four actively exploited flaws to its KEV catalog. The standout is an OpenSSH bug on Linux systems using musl libc without PAM, such as Alpine Linux, where some setups accept any long password.