Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access Ravie LakshmananNov 10, 2026Vulnerability / Cyber Attack French software company Vates VMS has warned of a critical security vulnerability in Xen Orchestra that it said is being actively exploited in the wild. The authentication bypass flaw, which does not yet have a CVE identifier, is tracked as VSA-2026-062. "REST cookie parsing turns authenticationToken=j:%7B%7D into {}," Vates VMS said in an alert. "REST authentication passes that object to the XO token provider without requiring a string." "The token collection treats {} as an unfiltered lookup and returns its first token; the provider authenticates as that token's owner if it is unexpired. The authenticated /rest/v0/users/me/authentication_tokens route then returns reusable login token IDs." In other words, the vulnerability can allow an attacker to bypass authentication by sending a specially crafted cookie and perform arbitrary actions with "Admin" privileges, ultimately resulting in arbitrary code execution on managed pools and a full XCP-ng node takeover as root. Vates VMS said it's seeing the vulnerability being actively exploited by a threat actor from the following IP address and TOR domain - 91.211.251[.]112:8001, which has been flagged as a RedLine Stealer command-and-control (C2) server on VirusTotal ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid[.]onion:3333 It's unclear when the activity started and if the vulnerability was exploited as a zero-day. Other indicators of compromise are listed below - HTTP requests containing authenticationToken=j:%7B%7D or authenticationToken=j:{} Virtual machines configured using "hvm_serial: file" parameter Suspicious files named /etc/cron.d/zz-ustar2, /etc/cron.d/zz-ustar, /.ustar5, and /.ustar6 The issue has been addressed in Xen Orchestra 6.9.1 and 6.10.0 for the stable and latest channels, as well as xo-server versions 5.211.2 and 5.213.1. If immediate patching is not an option, the following mitigations are advised - Avoid exposing Xen Orchestra instances on the internet Block the IP address and domain associated with malicious activity Block the empty token in a web application firewall (WAF) or a reverse proxy Rotate all passwords and secrets in Vates VMS if indicators of compromise are detected Filip Magic (@mad31k) and Christoffer Olsen from TDC NET Security have been credited with discovering and reporting the flaw. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. Authentication Security, Cyber Attack, Virtualization Security, Vulnerability Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs The Flood is Coming And The Pipes Were Already Full OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Watch Free Now Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. See how Identity Dark Matter impacts your GRC, IR, and Infrastructure. Watch the video. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk