Vates published security advisory VSA-2026-062 on 10 November 2026, rating a Xen Orchestra vulnerability (also in the Xen Orchestra Appliance) Critical; a CVSS 4.0 score is not available yet.

Vates says REST cookie parsing turns authenticationToken=j:%7B%7D into an empty object, which the token provider treats as an unfiltered lookup and authenticates as the owner of the first unexpired token, letting an adversary bypass authentication and act with Admin privilege; Vates says Xen Orchestra compromise can lead to arbitrary code execution on managed pools and full XCP-ng host takeover as root.

Vates says the vulnerability is actively exploited by a threat actor operating from 91.211.251.112:8001 and a Tor .onion address, and lists detection steps: HTTP requests containing authenticationToken=j:{} or j:%7B%7D, a VM named pivot2, VMs with an hvm_serial: file parameter, and files /etc/cron.d/zz-ustar, /etc/cron.d/zz-ustar2, /.ustar5 and /.ustar6 on XCP-ng hosts.

Vates says the absence of these indicators does not prove no compromise. Mitigations include not exposing Xen Orchestra to the internet, a dedicated management network, blocking the IP and Tor traffic, a WAF or reverse-proxy rule for the empty token, and rotating all Vates VMS passwords and secrets if compromised. Vates credits Filip Magic and Christoffer Olsen of TDC NET Security. (source: Vates)

Correction (11 Nov 2026): this card said the fix is in Xen Orchestra 6.10.0 and 6.9.1; Vates' advisory now says Xen Orchestra before 6.9.2 (stable) and 6.10.1 (latest) is affected and that 6.10.1 and 6.9.2 include the fix. (source: Vates VSA-2026-062)