Vates Warns of Actively Exploited Critical Xen Orchestra Flaw

The Xen Orchestra flaw designated VSA-2026-062 allows authentication bypass and administrator-level access. Vates classified it as critical on November 10, 2026, and said it is actively exploited. It affects Xen Orchestra and Xen Orchestra Appliance (XOA), which are used to centrally manage XCP-ng virtualization infrastructure.

According to the advisory, an attacker can use a specially crafted REST cookie to bypass the login process. This may provide access with Admin privileges in the Xen Orchestra interface. Vates also warns that compromising this management console could enable code execution in managed pools and subsequent takeover of an XCP-ng host with root privileges.

Xen Orchestra flaw: fixes available

In the Resolution section, Vates lists xo-server 5.213.1 for the latest channel and xo-server 5.211.2 for the stable channel as fixed releases. It recommends that administrators update without delay and not expose Xen Orchestra directly to the internet.

However, the advisory contains a version discrepancy: the Affected Versions section mentions xo-server 5.213.2, while the Resolution section identifies version 5.213.1 as the fix. When deploying the update, administrators should therefore follow the current procedure in the official Resolution section and the update channel they use.

Risk to the virtualization management layer

The significance of the issue stems from Xen Orchestra’s role in the infrastructure. This is not merely access to a single virtual machine, but to a central console that can manage XCP-ng pools and host nodes. An attacker with administrator privileges in the console could therefore, according to Vates, affect the managed environment as well.

Organizations that have the Xen Orchestra or XOA interface accessible from the internet and use it to manage production XCP-ng pools face the greatest risk. Confirmation of active exploitation means that simply planning future maintenance may not be an adequate response.

Checking for possible compromise

Along with the fix, Vates published indicators of compromise. They include cookie patterns, a virtual machine named pivot2, and selected files or cron jobs on XCP-ng hosts. Administrators should compare these indicators with their environments, especially if the management interface was externally accessible.

• Update Xen Orchestra according to the latest or stable channel specified in the Resolution section.
• Do not expose the Xen Orchestra interface directly to the internet, as Vates recommends.
• Check systems against the published indicators of compromise, including the VM name pivot2 and suspicious files or cron jobs on XCP-ng hosts.
• Check whether the advisory has been corrected with regard to the affected versions or supplemented with additional instructions.

No CVE or CVSS score has yet been listed for VSA-2026-062. The critical designation is Vates’ assessment. The company attributes the activity to specific attack infrastructure, but the scope of the campaign, the number of affected organizations, and independent confirmation of the actor’s identity have not been disclosed.

Further information may come from any future CVE and CVSS assignment, an explanation of the differing versions in the advisory, and updated indicators of compromise from Vates.

Verified and updated: November 11, 2026 06:25