Xen Orchestra is a web-based management platform for XCP-ng and XenServer virtualization environments: VMs, hosts, storage and backup. According to Vates, the flaw (VSA-2026-062, no CVE yet) is in the REST API authentication mechanism and lets an attacker with network access to the management interface log in as an admin without credentials. The company says such a compromise can lead to code execution and full takeover of an XCP-ng host as root.
The flaw affects Xen Orchestra releases before 6.9.2 (stable) and 6.10.1 (latest), and the Xen Orchestra Appliance. According to SecurityWeek, Vates also disclosed a second flaw that the same attacker exploited after gaining admin rights, through malicious VM imports; a fix for it is still being developed.
What to do: update now; move the Xen Orchestra interface to a dedicated management network; block the addresses published as indicators of compromise; and rotate potentially exposed credentials. Vates notes that this unauthorized access is not logged and that the absence of the published indicators does not prove no compromise occurred. For a confirmed compromise, it recommends a full reinstallation.
