Reported by 2 outlets
The story so far
AI summary of the reporting below · Updated · How we work
French software firm Vates is warning that attackers are actively exploiting a critical authentication bypass vulnerability in its Xen Orchestra management platform and the Xen Orchestra Appliance. Tracked as VSA-2026-062, the security flaw allows remote hackers with network access to bypass login safeguards and obtain administrator privileges, which Vates cautions can lead to arbitrary code execution across managed pools and full root takeovers of XCP-ng nodes. [1][2]
The weakness involves how Xen Orchestra handles authentication tokens sent through REST API requests. Attackers exploit it by submitting a specially crafted cookie containing an empty JSON object, tricking the system into retrieving an existing token and logging them in without credentials. Intruders can then collect reusable login tokens from an API endpoint to maintain access. [2]
Security researchers Filip Magic and Christoffer Olsen of TDC NET Security discovered the issue, prompting Vates to release fixes in Xen Orchestra versions 6.9.1 and 6.10.0 alongside patched xo-server packages 5.211.2 and 5.213.1. Vates urges administrators to update immediately or isolate management interfaces to dedicated networks, cautioning that standard logs will not record the malicious cookies without dedicated HTTP monitoring. [2]
A critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in attacks that could grant administrator privileges and allow takeover of XCP-ng virtualization hosts.
via BleepingComputerA critical authentication bypass allows attackers to execute arbitrary code as admin and take over XCP-ng nodes.
via SecurityWeek