Follow us on Google News
A critical security vulnerability in Xen Orchestra, a platform used to manage virtual machines and server infrastructure, is being actively exploited by hackers to bypass authentication and potentially gain complete control of affected systems.
The software’s developer, Vates, confirmed the attacks in a security advisory issued on November 10, 2026. The company warned that the vulnerability could allow attackers to obtain administrator-level privileges without valid login credentials and ultimately compromise the underlying servers.
The security flaw, identified under advisory VSA-2026-062, affects vulnerable Xen Orchestra installations, including the Xen Orchestra Appliance. Vates has released fixes and urged organisations to update immediately, particularly if their management interfaces are accessible from the internet.
How Hackers Are Bypassing Server Authentication
Xen Orchestra is a management platform that allows IT administrators to create, monitor, control and back up virtual machines. These virtual machines operate as separate computing environments on physical servers and are widely used for business applications and IT infrastructure.
The vulnerability arises from improper handling of authentication tokens, which are digital credentials used to identify authorised users. Under normal circumstances, the platform should verify these credentials before allowing access to its management functions.
However, researchers discovered that a specially constructed authentication cookie containing an empty object could interfere with the verification process. Instead of rejecting the request, the software could retrieve an existing authentication token and treat the attacker as a legitimate user.
The weakness could also allow attackers to obtain reusable login token identifiers. This creates opportunities for continued unauthorised access, depending on the permissions associated with the retrieved token.
The danger becomes particularly serious when administrative privileges are obtained. Attackers could then control virtual machines, change configurations and potentially execute malicious commands across connected infrastructure.
Active Exploitation Raises Concerns Over Server Takeovers
Vates confirmed that attackers have already exploited the vulnerability in real-world incidents. Its advisory identified malicious infrastructure associated with the observed campaign, including an internet address and a Tor-based communication endpoint.
The company warned that compromising Xen Orchestra could enable attackers to execute commands on managed server pools. In the most serious scenario, this could lead to complete takeover of an XCP-ng host with root privileges, the highest level of administrative access in a Linux-based environment.
Such access could expose multiple virtual machines running on the same infrastructure. Depending on the systems involved, attackers might be able to interfere with business applications, access sensitive information or disrupt services.
The potential impact extends beyond the management interface itself. A single compromised virtualisation management platform may provide attackers with access to several interconnected computing environments.
Vates also identified suspicious activity associated with a virtual machine named pivot2 and unusual files on affected hosts. These indicators may help security teams investigate possible compromises.
However, the company cautioned that these indicators relate only to the attack activity identified so far. Their absence does not necessarily mean a system has remained secure, particularly if other attackers have adopted different techniques.
Emergency Security Updates Released For Affected Systems
Vates has issued fixes for both its stable and latest software channels. Its November 10 advisory identifies Xen Orchestra 6.9.1 and 6.10.0 as updated releases containing the correction.
The corresponding fixed xo-server package versions are 5.211.2 for the stable channel and 5.213.1 for the latest channel.
Organisations operating Xen Orchestra have been urged to install the security updates without delay. The developer has also recommended keeping management interfaces away from the public internet and placing them on dedicated management networks.
Security teams should examine their environments for signs of suspicious activity, particularly unexpected virtual machines, unusual server configurations and files associated with the reported campaign.
Where a compromise is suspected or confirmed, simply applying the software update may not be sufficient. Attackers could already have obtained credentials or established other means of maintaining access.
Vates therefore recommends changing passwords and other sensitive credentials used by affected systems, including administrator accounts, backup services and connected storage platforms.
What This Means For You
For organisations using Xen Orchestra, the immediate priority is to identify vulnerable installations and apply the available updates. Administrators should also check whether their management interfaces are exposed to the internet.
The incident highlights how vulnerabilities in centralised IT management tools can create risks far beyond a single application. A compromised management platform may place numerous business systems and their data at risk.
Even organisations that have not detected suspicious activity should review their server access controls and investigate any unexplained administrative changes.
Because the vulnerability is already being exploited, delaying security updates could leave critical infrastructure exposed to further attacks.
