Severity: Critical | Priority: 1
A critical authentication bypass in Xen Orchestra, the web-based management platform for XCP-ng and Xen virtualisation environments, is being actively exploited. The flaw is tracked by its developer Vates as VSA-2026-062, and no CVE has been assigned yet. By sending a specially crafted login cookie, an attacker who has no account can make Xen Orchestra treat the request as coming from an existing logged-in user, often an administrator. The attacker can then request reusable login tokens from the server and keep access even after the original session ends. Because Xen Orchestra controls the entire virtualisation pool, this gives the attacker the ability to create, change and run virtual machines, execute code on the managed hosts, and take root-level control of XCP-ng servers.
Vates reports active attacks, which it links to a campaign it calls “ustar”. After gaining access, the attackers:
The attackers have also been seen connecting to a known malicious address and to a Tor hidden service. The malicious request leaves no trace in Xen Orchestra’s own logs, so organisations may not know they have been compromised.
Administrators should update Xen Orchestra immediately. The fixed xo-server versions are 5.211.2 on the stable channel and 5.213.1 on the latest channel. Check the installed xo-server version directly, because published release numbers have varied between sources. Remove Xen Orchestra from direct internet access and place it on a dedicated management network reachable only by administrators. On every XCP-ng host, check for:
Revoke all existing Xen Orchestra login tokens, and review administrator accounts, API tokens and recent VM imports. Where compromise is confirmed, treat the affected XCP-ng hosts as fully compromised: rebuild them from known-good media and rotate all credentials and keys stored in Xen Orchestra.