Xen Orchestra Flaw Used in Attacks: Update to 6.9.2 or 6.10.1

On November 10, Vates, the company behind the XCP-ng virtualization platform, published a critical security advisory for Xen Orchestra, the web console many businesses and IT providers use to manage, back up and restore XCP-ng virtual servers. Vates says a threat actor is actively exploiting the flaw. It does not have a CVE number yet; Vates tracks it as VSA-2026-062.

The short version: if you run XCP-ng, make sure Xen Orchestra is on version 6.9.2 (stable) or 6.10.1 (latest) or later, and that the console cannot be reached from the internet.

What the flaw does

Vates says a specially crafted login cookie can trick Xen Orchestra into signing an attacker in as an existing user, with Admin privileges, without a password. From there, Vates says an attacker can run code on the managed servers and take full control of an XCP-ng host. Vates also notes that this kind of unauthenticated access does not show up in the Xen Orchestra logs.

The same attacker also abused a second issue, VSA-2026-063, which lets a user with VM import rights bring in a crafted virtual machine to compromise a host. As of November 10, Vates said a fix for that one was still in progress.

Who is at risk

Any business running Xen Orchestra before 6.9.2 (stable channel) or 6.10.1 (latest channel), including the Xen Orchestra Appliance. The risk is highest where the console is reachable from the internet.

What to do this week

1. Update Xen Orchestra. Install 6.9.2 or 6.10.1 (xo-server 5.211.2 or 5.213.1). If it was installed from source, update to the latest version from Vates.
2. Keep the console off the internet. Vates recommends putting Xen Orchestra on a dedicated management network, reached only through a VPN.
3. Limit VM import rights to Admin users until Vates ships the fix for the second issue.
4. Check for signs of compromise. Vates' advisory lists addresses to block and what to look for. If anything suspicious turns up, Vates advises changing all passwords and secrets the system uses, including backup storage logins, and rebuilding a confirmed-compromised system rather than just cleaning it.

Questions to ask your IT provider

1. Do we use XCP-ng or Xen Orchestra, and what version is it on?
2. Can the Xen Orchestra console be reached from the internet?
3. Who has VM import rights, and have we checked the indicators Vates published?