Xen Orchestra login can be bypassed to take over virtual machine hosts, and is under attack (VSA-2026-062)

13 November 2026CriticalBeing exploited

Vates · Xen Orchestra and Xen Orchestra Appliance (XCP-ng management) · VSA-2026-062

Xen Orchestra login can be bypassed to take over virtual machine hosts, and is under attack

Xen Orchestra is the web console used to manage XCP-ng virtualisation servers. A flaw in how it checks login cookies lets someone who can reach the console skip the login and act as an administrator, and from there run code on the managed pools and take over the hosts as root. Vates rates it critical and says it is being actively exploited by a threat actor. No CVE or CVSS score has been assigned yet; Vates tracks it as VSA-2026-062. A related flaw in VM import (VSA-2026-063), which Vates says the same attacker has abused, has no fix yet.

Affected: Xen Orchestra before 6.9.2 (stable channel) and before 6.10.1 (latest channel), and the Xen Orchestra Appliance. Consoles reachable from the internet are most at risk. VSA-2026-063 affects Xen Orchestra 6.10.1 and earlier, where users who are not administrators hold VM import permissions.
What to do: Update to Xen Orchestra 6.9.2 (stable) or 6.10.1 (latest), which include xo-server 5.211.2 and 5.213.1; if you installed from source, update to the latest master. Some early press reports name 6.9.1 and 6.10.0, so go by the Vates advisory. For VSA-2026-063, which is not yet fixed, Vates's mitigation is to restrict VM import to the Admin user by disabling users who hold that permission. Do not expose Xen Orchestra to the internet: keep it on a dedicated management network. Vates warns that a successful attack leaves no login entry in Xen Orchestra's logs, so work through the indicators in its advisory (the listed IP addresses, an unexpected running VM named pivot2, and unfamiliar cron files on XCP-ng hosts). If the console may have been compromised, rotate every password and secret it holds, and reinstall if compromise is confirmed.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
Why it’s here: Confirmed exploited by the vendor, with full takeover of the servers that host a business's virtual machines; covered by the security press.

Xen Orchestra login can be bypassed to take over virtual machine hosts, and is under attack

Affected

Xen Orchestra before 6.9.2 (stable channel) and before 6.10.1 (latest channel), and the Xen Orchestra Appliance. Consoles reachable from the internet are most at risk. VSA-2026-063 affects Xen Orchestra 6.10.1 and earlier, where users who are not administrators hold VM import permissions.

What to do

Update to Xen Orchestra 6.9.2 (stable) or 6.10.1 (latest), which include xo-server 5.211.2 and 5.213.1; if you installed from source, update to the latest master. Some early press reports name 6.9.1 and 6.10.0, so go by the Vates advisory. For VSA-2026-063, which is not yet fixed, Vates's mitigation is to restrict VM import to the Admin user by disabling users who hold that permission. Do not expose Xen Orchestra to the internet: keep it on a dedicated management network. Vates warns that a successful attack leaves no login entry in Xen Orchestra's logs, so work through the indicators in its advisory (the listed IP addresses, an unexpected running VM named pivot2, and unfamiliar cron files on XCP-ng hosts). If the console may have been compromised, rotate every password and secret it holds, and reinstall if compromise is confirmed.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

Why it’s here

Confirmed exploited by the vendor, with full takeover of the servers that host a business's virtual machines; covered by the security press.