Vates VMS has warned that an authentication bypass in Xen Orchestra is being exploited in the wild, with attackers reaching admin rights on virtualisation pools.
The French vendor tracks it as VSA-2026-062. No CVE identifier has been assigned.
Why the cookie check collapsed
The mechanism is a parsing shortcut, not a memory bug. A REST cookie carrying authenticationToken with an encoded empty object is decoded to a bare object, and the token provider is handed that object without the string type check it expects.
The token collection then treats the empty object as an unfiltered lookup and returns its first entry. If that token has not expired, the provider authenticates the request as its owner.
From there the attacker can call the authenticated token listing endpoint and collect reusable login token identifiers.
Practical effect: arbitrary actions as Admin, code execution on managed pools, and root takeover of an XCP-ng node.
Fixes and what to hunt for
Patched builds are Xen Orchestra 6.9.1 and 6.10.0 for the stable and latest channels, with xo-server 5.211.2 and 5.213.1.
Vates attributes the activity to a single actor and published two indicators: an address it says VirusTotal has flagged as RedLine Stealer command-and-control, and a Tor hidden service on port 3333.
Hunt for HTTP requests containing the empty-object cookie form, a running VM named pivot2, VMs configured with an hvm_serial file parameter, and cron files or dotfiles named zz-ustar, zz-ustar2, ustar5 and ustar6.
A second flaw, VSA-2026-063, is being used alongside it to smuggle a malicious VM image onto a host and is not yet fixed. Restrict VM import to admin accounts and stop exposing the interface to the internet meanwhile.
