A newly uncovered vulnerability in Xen Orchestra is being actively exploited and can allow attackers to gain full root access on XCP-ng hypervisor nodes. The flaw, called VSA-2026-062, involves an authentication bypass that turns specially crafted cookies into valid admin sessions, leading to total takeover. The company behind Xen Orchestra issued patches in recent builds to address the issue and offered urgent mitigation strategies.
How the Vulnerability Works
The bug arises in Xen Orchestra’s REST API where cookie parsing misinterprets an attribute setting that skips the usual authentication token checks. Specifically, when an attacker sends a cookie parameter set to “authenticationToken=j:%7B%7D” (or its decoded form “authenticationToken=j:{}”), Xen Orchestra treats it as an object rather than a string. The REST authentication process then uses this malformed token to bypass identity verification, granting admin privileges. Once authenticated at that level, a malicious actor can perform arbitrary actions including executing code on managed pools and seizing control of the underlying XCP-ng node as root.
Current Exploitation & Indicators
The maker of Xen Orchestra, Vates VMS, confirmed that this vulnerability is already seeing real-world abuse. Attack traffic has been traced to a public IP address linked to a known RedLine malware command-and-control server. Also involved is a TOR domain accessed via port 3333 used for coordinating attacks.
Signatures of compromise include HTTP requests carrying a token value “authenticationToken=j:%7B%7D” or “authenticationToken=j:{}”, virtual machines bearing names like “pivot2”, VMs configured with the parameter “hvm_serial: file”, and suspicious cron jobs or files under system paths such as /etc/cron.d/zz-ustar2 or /.ustar5.
Patches and Protections
Fixes for Xen Orchestra were released recently: versions 6.9.1 and 6.10.0 (stable and latest channels) as well as xo-server releases 5.211.2 and 5.213.1 include the remedy for this bug.
For organizations unable to immediately update, several mitigation steps are advised: avoid exposing Xen Orchestra to the public internet; block the malicious IP and TOR domain tied to observed attacks; configure web application firewalls or reverse proxies to reject empty or malformed authentication tokens; and rotate all credentials and secrets if any of the compromise indicators are present in your environment.
Who Discovered It
Security researchers Filip Magic and Christoffer Olsen from TDC NET reported the issue to Vates VMS, prompting the alert and subsequent patch rollout.
This vulnerability matters because many organizations rely on Xen Orchestra to manage virtualization infrastructure. With a vulnerability that leads straight to root access, the potential for damage—from ransomware to data exfiltration—is extremely high. Operators should verify they are using the patched versions immediately, monitor for signs of abuse especially in exposed instances, and treat this as a stark example of how subtle parsing logic can undermine major system security.
