French software company Vates has warned that a critical authentication bypass in Xen Orchestra is being actively exploited, giving attackers administrator access to virtualisation management and a route to full takeover of the XCP-ng hosts it manages. The flaw, tracked as VSA-2026-062, was disclosed on 10 November 2026, and no CVE identifier or CVSS score had been assigned at the time of the advisory.

Xen Orchestra is the web-based management platform for XCP-ng virtualisation environments, used to manage virtual machines, hosts and pools. Because it sits at the centre of a virtualisation estate, an attacker who controls it can reach every host and virtual machine underneath it.

An empty cookie that logs in as admin

The flaw lies in how Xen Orchestra handles authentication tokens sent through REST API requests. Vates said REST cookie parsing turns a specially crafted cookie, authenticationToken=j:%7B%7D, into an empty JavaScript object. That object is passed to the token provider without requiring a string, and the token collection treats it as an unfiltered lookup and returns its first token.

The provider then authenticates the attacker as that token's owner, if the token has not expired. The authenticated route for listing a user's tokens then returns reusable login token IDs. In short, an attacker with network access to the management interface needs no username or password to act with administrator privileges.

Vates said the flaw can lead to arbitrary code execution on managed pools and a full XCP-ng node takeover as root. It is not yet clear when the exploitation began, or whether the flaw was exploited as a zero-day before the fix was available.

Attack activity and indicators to check

Vates said it is seeing the flaw exploited by a threat actor operating from the IP address 91.211.251.112 on port 8001, which has been flagged as a RedLine Stealer command-and-control server on VirusTotal, and from a Tor onion service on port 3333. Administrators should check for HTTP requests containing the empty-token cookie, a running virtual machine named pivot2, virtual machines configured with the "hvm_serial: file" parameter, and suspicious files named /etc/cron.d/zz-ustar2, /etc/cron.d/zz-ustar, /.ustar5 and /.ustar6.

Vates also warned that successful exploitation will not necessarily leave identifiers in application logs, such as the use of the specially crafted cookie, so teams may need HTTP monitoring to spot it. The published indicators cover only the campaign Vates has observed, so their absence does not prove a system is clean.

Patch now, and keep it off the internet

The flaw is fixed in Xen Orchestra 6.9.2 for the stable channel and 6.10.1 for the latest channel, with patched xo-server packages 5.211.2 and 5.213.1, according to the current Vates advisory. The flaw was discovered and reported by Filip Magic and Christoffer Olsen of TDC NET Security.

Administrators should upgrade immediately, and should not expose Xen Orchestra to the internet. Where immediate patching is not possible, Vates advises blocking the IP address and domain linked to the malicious activity, blocking the empty token in a web application firewall or reverse proxy, and rotating all passwords and secrets if any indicator of compromise is found. Any organisation running Xen Orchestra should treat this as an urgent patch, because the exploit is already in use and the fix is available.