Xen Orchestra auth bypass VSA-2026-062 exploited; patches out
First merged summary.
Attackers are exploiting critical Xen Orchestra bypass VSA-2026-062; Vates has released fixes and no CVE is assigned.
Vates says attackers are exploiting a critical authentication bypass in Xen Orchestra and the Xen Orchestra Appliance, tracked as VSA-2026-062. Remote access to the management interface lets a crafted cookie be treated as a token lookup, yielding Admin rights, code execution on managed pools, and root takeover of XCP-ng nodes. No CVE or CVSS score has been assigned. Patches are Xen Orchestra 6.9.1 and 6.10.0 and xo-server 5.211.2 and 5.213.1. BleepingComputer says the empty object signs the attacker in as an existing token owner; The Hacker News says lookup returns the first unexpired token.
- Filip Magic and Christoffer Olsen of TDC NET Security found the flaw.
- Fixes are Xen Orchestra 6.9.1 and 6.10.0, plus xo-server 5.211.2 and 5.213.1.
- Vates cites connections to 91.211.251.112 on port 8001 and Tor infrastructure.
- Indicators include a VM named pivot2 and ustar cron or hidden files.
- The crafted cookie is not logged; Vates advises HTTP monitoring.
What each outlet adds
beyond the shared facts- BleepingComputerNames the discoverers, onion port 3333, and that the cookie is not logged.
- The Hacker NewsVirusTotal RedLine label, extra ustar filenames, and offline-isolation advice.
- Malware
- RedLine Stealer
- Organizations
- TDC NET Security
Coverage
oldest first · one row per article · UTC- · 13h ago
BleepingComputerFirst report
Xen Orchestra auth bypass exploited to take over XCP-ng hosts
A crafted empty-JSON cookie logs attackers in as an existing token owner; Vates fixed it in 6.9.1 and 6.10.0.
- · 11h ago
The Hacker News
Xen Orchestra auth bypass exploited for admin and root access
Vates fixed VSA-2026-062, which has no CVE yet, in Xen Orchestra 6.9.1 and 6.10.0 and xo-server 5.211.2 and 5.213.1.