Summary
- Vates confirms active exploitation of VSA-2026-062, an authentication bypass affecting Xen Orchestra and its appliance.
- Successful exploitation can provide administrative privileges and potentially compromise managed XCP-ng hosts.
- Corrected xo-server packages are available, while the separate VM import vulnerability remained unfixed on 10 November.
Attackers are actively exploiting a critical authentication vulnerability in Xen Orchestra that can grant administrative control over virtualisation management systems and potentially expose the infrastructure they manage.
The vulnerability, tracked as VSA-2026-062, was disclosed on 10 November by French infrastructure software company Vates. It affects Xen Orchestra and the Xen Orchestra Appliance, which provide administration and orchestration capabilities for XCP-ng virtualisation environments.
Vates has classified the flaw as critical and confirmed that a threat actor is exploiting it. At the time of the advisory, the issue had not been assigned a CVE identifier or numerical CVSS score.
The weakness arises from the handling of authentication tokens in Xen Orchestra’s REST interface. Under specific conditions, incorrectly validated token information can be accepted during authentication, allowing an unauthorised requester to gain access using an existing token.
Vates says successful exploitation can provide administrative privileges. From that position, attackers may be able to execute commands across managed pools and ultimately compromise an XCP-ng host with root-level access.
This is a vulnerability in the management software, rather than the same hypervisor memory-isolation weaknesses disclosed in early November. The distinction affects both the attack path and the systems that must be examined.
Management access creates wider exposure
Xen Orchestra provides centralised administration of virtual machines, hosts and supporting infrastructure. Its privileged position allows legitimate administrators to perform operations that individual virtual machines cannot ordinarily carry out.
Compromise of that management layer can therefore place multiple workloads at risk, even where their operating systems and applications have been separately maintained and patched.
The potential impact is particularly important for hosting providers and organisations operating shared virtualisation estates. A management account with broad permissions may have access to several hosts or pools, extending the consequences of one compromised administrative service.
Vates’ advisory identifies attacker-controlled infrastructure associated with observed exploitation and provides indicators that administrators can use during incident investigation. These include unusual virtual machine configurations and artefacts that may remain on affected hosts.
The company also recommends restricting access to Xen Orchestra management services, including avoiding direct internet exposure and keeping administrative interfaces on dedicated management networks.
These measures reduce exposure to remote attackers, but they do not replace the software correction. Nor does the absence of a known indicator necessarily establish that a previously exposed management environment was not compromised.
Vates identifies xo-server 5.213.1 for the latest channel and 5.211.2 for the stable channel as corrected packages. However, the vendor’s advisory has contained inconsistent wording about affected and fixed Xen Orchestra release numbers. Administrators should verify the installed xo-server package against the current advisory rather than treating a Xen Orchestra version label alone as evidence that the vulnerability has been corrected.
Separate import vulnerability remains unresolved
Vates also published a separate advisory, VSA-2026-063, concerning the permissions used when importing virtual machines into Xen Orchestra.
That issue can allow users with certain lower-level import or network management privileges to submit configurations capable of compromising an XCP-ng host. Vates says the path was abused by a threat actor that had obtained administrative privileges through the authentication weakness.
The second advisory is distinct from VSA-2026-062 and carries its own remediation status. As of 10 November, Vates had not released a complete software fix for VSA-2026-063, although it identified restrictions on import-related permissions as a mitigation.
Consequently, applying the authentication patch should not be taken as confirmation that the separate import-related weakness has also been corrected.
The combination of these findings illustrates the importance of distinguishing weaknesses in the virtualisation management plane from vulnerabilities within the hypervisor itself. Administrative software can provide extensive control over otherwise isolated workloads, and weaknesses in its authentication or authorisation processes may undermine that separation.
For organisations operating managed infrastructure, incident investigation may need to extend from the Xen Orchestra application to the hosts and virtual machines it controls. A compromised administrator session can leave consequences beyond the original login event.
Vates has published both advisories with information on affected installations, available fixes, mitigations and observed attacker activity. The authentication bypass has a released correction, while the separate import vulnerability remained under active remediation in the company’s 10 November disclosure.
