Vates said in a security advisory that a critical flaw in Xen Orchestra is being actively exploited. Xen Orchestra is Vates's web tool for managing XCP-ng virtual machines, hosts and pools. The flaw, tracked as VSA-2026-062, lets an attacker skip the login by sending a crafted cookie. Vates said the attacker then gets admin rights. That can lead to code running on managed pools and root control of XCP-ng hosts. Vates named the attacker's servers: 91.211.251.112 on port 8001, and a Tor address. Filip Magic and Christoffer Olsen of TDC NET Security found the flaw.
Vates said fixes are on its stable and latest channels. It lists versions 6.9.2 and 6.10.1. BleepingComputer reported 6.9.1 and 6.10.0 instead. Both name xo-server packages 5.211.2 and 5.213.1. BleepingComputer said no CVE number or severity score has been assigned yet. Vates said a successful attack leaves no log entry, so it must be spotted by watching network traffic. Its warning signs cover only this one campaign, and other attackers may act differently. Vates also said stolen settings and passwords cannot be ruled out.
Anyone who runs Xen Orchestra controls every virtual machine it manages, so a bypass here exposes all of them. Vates urges updating at once, keeping the tool off the internet and placing it on a dedicated management network. If a system was breached, Vates advises changing all passwords and secrets, and reinstalling from scratch.