Vates has warned that a threat actor exploited Xen Orchestra’s login bypass to gain administrator access and also abused a separate VM import flaw using those privileges, according to SecurityWeek. The second vulnerability could compromise XCP-ng virtualization hosts. Source
Xen Orchestra is Vates’ web-based backup, management and disaster recovery platform for virtualization environments, controlling hosts, virtual machines, storage and pools. Source Source
“Xen Orchestra compromise can lead to arbitrary code execution on managed pools and a full XCP-ng node takeover as root,” Vates warned, as quoted by SecurityWeek. Source
Two flaws, different entry requirements
The authentication bypass, tracked by Vates as VSA-2026-062, requires network access to Xen Orchestra’s management interface—not existing administrator credentials, BleepingComputer reports. It affects Xen Orchestra and the Xen Orchestra Appliance. Source
When an authentication cookie contains an empty JSON object, the system treats that object as an unfiltered lookup and returns the first token in the collection, SecurityWeek reports. If that token hasn’t expired, the system authenticates the requester as its owner. The flaw can grant administrator privileges and expose reusable login token IDs. Source Source
An empty JSON object should not double as a set of keys.
SecurityWeek reports that the same threat actor used administrator privileges to exploit the second flaw through malicious VM imports that could compromise XCP-ng hosts. A fix was still in development when the outlet reported the issue. Source
Fixing the login isn’t the whole job
BleepingComputer and SecurityWeek report different release thresholds for the authentication bypass. Administrators should consult Vates’ current advisory and release guidance before choosing an update. Source Source
Vates’ containment recommendations, as reported by SecurityWeek, include:
- Restricting Xen Orchestra access to a dedicated management network.
- Blocking IP addresses and domains associated with known malicious activity.
- Using a web application firewall rule to block the empty authentication token.
- Rotating all potentially compromised credentials. Source
After confirmed compromise, Vates recommends a full reinstallation because cleanup alone cannot guarantee that every attacker backdoor has been removed, SecurityWeek reports. Source
Missing indicators aren’t an all-clear
BleepingComputer lists campaign indicators including connections to 91.211.251.112:8001, a VM named pivot2, VM configurations containing hvm_serial: file, and files such as /etc/cron.d/zz-ustar, /etc/cron.d/zz-ustar2, /.ustar5 and /.ustar6. Source
BleepingComputer reports that the crafted-cookie identifiers are not recorded in logs; detecting those requests requires HTTP monitoring. Source
Vates also cautions that its indicators cover the observed campaign, not every possible exploitation method. Their absence alone cannot establish that an installation is uncompromised. Source
Comments