Xen Orchestra VSA-2026-062

What it is. A login bypass in the Xen Orchestra REST API. Vates says an attacker needs no account and ends up with Admin privilege in Xen Orchestra. Because Xen Orchestra controls the hosts it manages, Vates says this can lead to code execution on managed pools and root on XCP-ng hosts.

Affected, per Vates. Xen Orchestra before 6.9.2 (stable) and 6.10.1 (latest), and the Xen Orchestra Appliance. Installs built from source are affected until updated to the latest master.

Not to be confused with. VSA-2026-063, a separate Xen Orchestra advisory Vates published the same day. This page covers VSA-2026-062 only.

Checks. Run these only on systems your organization owns.

1. Which version is running? This decides exposure. Check the Xen Orchestra version, or the xo-server package version (5.211.2 or later on stable, 5.213.1 or later on latest). For installs built from source, confirm when the code was last pulled.
2. Can an untrusted network reach the Xen Orchestra web interface? Check from the internet and from user networks. Vates' first mitigation is to keep Xen Orchestra off the internet and on a dedicated management network.
3. Has it already been hit? Vates says the absence of its indicators does not prove you are clean, and a successful login bypass is not logged by Xen Orchestra. Run the host checks in the detection section below on every XCP-ng host the console manages.

Identities involved. A compromised Xen Orchestra exposes every secret it holds. Vates lists proxy credentials, backup remote credentials (NFS, S3, Azure, SMB), root accounts and the pool secret, user accounts, OTP secrets and mail server passwords.

Vates says to update as soon as possible. These are the mitigations Vates lists until you can.

• Keep Xen Orchestra off the internet. Vates says not to expose it to the internet and to put it on a dedicated management network.
• Block the attacker's infrastructure. Vates recommends blocking traffic to and from the IP addresses in its advisory, and blocking Tor traffic, to break the attacker's command and control.
• Add a WAF or reverse proxy rule. Vates gives a request pattern to block and warns that "the rule can be bypassed using other formats." Treat it as a stopgap only.
• Rotate secrets if Xen Orchestra was compromised. Vates says configuration theft and credential harvesting cannot be ruled out, and recommends rotating every password and secret Xen Orchestra uses.
• Reinstall after a confirmed compromise. Vates says "a full reinstallation is recommended as cleanup alone cannot guarantee the removal of all backdoors left by the attacker."

Vates' indicators cover the one campaign it has seen so far. Vates says other attackers may use different methods, and the absence of these indicators is not enough to conclude you were not compromised.

• Xen Orchestra. A successful bypass leaves no log entry. Vates says it can be found only by watching HTTP requests to Xen Orchestra, and its advisory lists the request patterns to search for.
• Unexpected VMs. Look for a running VM named pivot2.
• VMs with a serial port writing to a file. On XCP-ng hosts, run xe vm-list params=name-label,platform | grep -B1 'hvm_serial: file', and search /var/log/xensource.log* for -serial file:.
• Files on XCP-ng hosts. Look for /etc/cron.d/zz-ustar, /etc/cron.d/zz-ustar2, /.ustar5 and /.ustar6. Vates' check also lists /etc/ld.so.preload. That file exists legitimately on some systems, so check it for entries you don't recognize.
• Network traffic. Connections to or from 91.211.251.112, 193.148.56.72, 37.221.208.216, 45.66.35.11, 64.65.0.120, 64.65.62.160, 89.47.51.90 or 92.60.37.247, or Tor traffic from Xen Orchestra or the hosts.

Am I exposed to VSA-2026-062?

You are if you run Xen Orchestra older than 6.9.2 (stable) or 6.10.1 (latest), or the Xen Orchestra Appliance before those updates, and an untrusted network can reach its web interface. No login is needed, per Vates.

Is VSA-2026-062 being exploited?

Yes, per Vates, which says it "is actively exploited by a threat actor" and published the attacker's IP addresses and indicators. It has no CVE and is not on CISA KEV as of the November 10, 2026 catalog.

Is there a patch?

Yes. Vates released Xen Orchestra 6.9.2 on the stable channel and 6.10.1 on the latest channel on November 10, 2026. The fixed xo-server packages are 5.211.2 and 5.213.1. Installs built from source should update to the latest master.

Why do news reports say 6.9.1 and 6.10.0?

Vates' advisory names 6.9.2 and 6.10.1 as the versions that include the fix. Use Vates' numbers.

How do I know if I was hit?

Xen Orchestra does not log a successful bypass. Use the host checks Vates lists, such as unexpected cron files, a VM named pivot2 and traffic to the attacker IPs. If you find signs of compromise, Vates recommends a full reinstall and rotating every secret Xen Orchestra holds.

Does this have a CVE?

Not yet. Vates lists the CVSS score as not available yet, and no CVE ID has been published.

Nov 11, 2026. First published. Vates says the flaw is actively exploited; fixed in Xen Orchestra 6.9.2 and 6.10.1; no CVE or CVSS yet; not on CISA KEV.

• Vates, VSA-2026-062: Empty-object login token (published Nov 10, 2026)
• Vates security advisories list
• CISA Known Exploited Vulnerabilities catalog (not listed; checked catalog version 2026.11.10)