Xen Orchestra VSA-2026-062: Active Exploitation and Fixes

Vates says attackers are actively exploiting VSA-2026-062, a critical Xen Orchestra authentication bypass disclosed on November 10, 2026. Update Xen Orchestra to 6.9.2 on the stable channel or 6.10.1 on the latest channel now. Xen Orchestra Appliance deployments are also affected.

The flaw crosses the management plane: an unauthenticated request can be accepted as the owner of an existing, unexpired token. Vates says the resulting access can carry Admin privileges and reach managed pools. An affected management service therefore needs both an urgent update and a compromise check.

VSA-2026-062 Fixed Versions and Exposure

Vates lists Xen Orchestra versions before 6.9.2 on stable and before 6.10.1 on latest as affected. Its November 10 security advisory also names Xen Orchestra Appliance. Check the running channel and version on every management instance, including appliances that administer multiple pools.

Vates recommends updating source installations to the latest master. The advisory does not present an appliance-specific version number. Confirm the installed Xen Orchestra build after any appliance update, then keep management access on a dedicated network.

How Does the Authentication Bypass Work?

At a high level, REST cookie parsing supplies an object where authentication expects a token string. The token lookup then treats that object as an unrestricted query and selects an existing token. If it has not expired, the service authenticates the requester as its owner.

Vates says the authenticated session can then obtain reusable login token identifiers. Its advisory describes possible Admin access, arbitrary code execution on managed pools and root-level takeover of an XCP-ng node. These are consequences of Xen Orchestra compromise; the advisory does not describe a separate XCP-ng patch for this flaw.

What Does Active Exploitation Mean for Risk?

Vates explicitly reports active exploitation by a threat actor. That makes Internet-reachable Xen Orchestra management a priority for immediate isolation and patching. The published detection guidance describes one observed campaign and cannot rule out other methods or infrastructure.

Brandefense Blackhole counted 584 posts matching Xen from August 13 through November 11, 2026. This broad term includes unrelated discussion, so the count is context for monitoring, not evidence of VSA-2026-062 exploitation. Vates’ direct exploitation statement is the basis for the urgent response.

What Should Defenders Do Now?

First, identify each Xen Orchestra instance and its channel, then install the fixed version. Remove direct Internet exposure and place the service on a dedicated management network. Review the attack surface around that management service, including any unintended public route. Our XenServer management network advisory provides related context, but its vulnerability and patches are separate.

• Inventory and update stable and latest instances to their fixed releases
• Restrict Xen Orchestra access to a dedicated management network
• Review HTTP telemetry and managed VMs using Vates’ detection guidance
• If compromise is confirmed, rotate management secrets and plan full reinstallation

Vates says a successful unauthenticated access has no corresponding Xen Orchestra log entry. Review available HTTP telemetry and managed VM inventory, while recognizing that a missing campaign indicator does not clear the system. Preserve relevant evidence before changing the environment; our incident response plan template can help order that work.

If Xen Orchestra was compromised, Vates advises rotating passwords and secrets used by Vates VMS. These include backup remote credentials, proxy settings, user accounts and pool secrets. For confirmed compromise, it recommends full reinstallation because cleanup may leave attacker access behind.