A critical authentication bypass vulnerability in Xen Orchestra is currently being exploited in the wild, potentially granting unauthorized actors administrator privileges and full control over XCP-ng virtualization hosts, based on information published by Bleeping Computer.
The security flaw, tracked as VSA-2026-062, impacts Xen Orchestra and the Xen Orchestra Appliance. By utilizing a specifically crafted cookie containing an empty JSON object, remote attackers can bypass authentication protocols without valid credentials. Once inside, adversaries can retrieve reusable login tokens to maintain access and execute arbitrary code on managed pools, effectively taking over XCP-ng nodes as root. Vates has confirmed active exploitation and released patched versions, specifically Xen Orchestra 6.9.1 and 6.10.0, to address the issue. Security researchers Filip Magic and Christoffer Olsen discovered the vulnerability. Indicators of compromise include suspicious connections to specific IP addresses and onion domains, as well as the presence of unauthorized files and modified virtual machine configurations. Because the exploit does not generate standard log entries, Vates advises administrators to monitor HTTP traffic for malicious cookie patterns. Organizations that suspect a compromise should immediately rotate all passwords and secrets associated with their virtualization environments and restrict management interface access to secure, dedicated networks.
Source: Bleeping Computer
