Xen Orchestra auth bypass exploited for admin and root access
Vates fixed VSA-2026-062, which has no CVE yet, in Xen Orchestra 6.9.1 and 6.10.0 and xo-server 5.211.2 and 5.213.1.
78
Organization
TDC NET Security
- Mentions · 7d2
- Mentions · 30d2
- All mentions2
- First seenNov 10, 2026
- Last mentioned11h ago
Timeline
2 articles · newest firstXen Orchestra auth bypass exploited to take over XCP-ng hosts
A crafted empty-JSON cookie logs attackers in as an existing token owner; Vates fixed it in 6.9.1 and 6.10.0.
82
Appears with
- xo-serverproduct · 2
- Xen Orchestraproduct · 2
- XCP-ngproduct · 2
- RedLine Stealermalware · 1
- Vatesvendor · 1
- Vates VMSvendor · 1
- Xen Orchestra Applianceproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.