Xen Orchestra auth bypass actively exploited; one crafted cookie gives admin
Vates disclosed on November 10 that a critical authentication bypass in Xen Orchestra, advisory VSA-2026-062, is being actively exploited: a cookie holding an empty JSON object is accepted during login, letting an unauthenticated attacker act with Admin privilege on the console that manages XCP-ng virtualisation pools.
📊 Scorecard: our Bearish call on $AVGO is scored from $345.22, the last close before it ran. Its first result comes after the next close.
The News
Vates, the French company behind Xen Orchestra, disclosed on November 10 that a critical authentication bypass in Xen Orchestra, advisory VSA-2026-062, is being actively exploited. The flaw is in the REST interface's handling of the authenticationToken cookie — the small token a browser sends to prove a user is logged in. A cookie value of an empty JSON object, written as j:%7B%7D, is accepted during authentication, letting an unauthenticated attacker act with Admin privilege on the console that manages XCP-ng virtualisation pools — the empty object returns the first unexpired login token, and Vates states the attacker can act with Admin privilege, with potential compromise of the managed hosts. XCP-ng is an open-source virtualisation platform: software that runs many virtual computers on a smaller number of physical servers. The console is the control room for all of them, so Admin access there is about as much access as the software can give.
The disclosure carries two features that make it worse than an ordinary bug. First, no CVE identifier or CVSS score had been assigned at disclosure — the standard public labels that help defenders track a flaw were missing, which makes it harder for teams to find and prioritise. Second, Vates warned that a successful exploit leaves no log entry of the unauthenticated access. A log entry is the record a system keeps of who did what; without one, a victim may not know they were hit, and may not know to look. Vates published indicators to help defenders check, including a command-and-control address, 91.211.251.112:8001, and a Tor endpoint — the addresses the attackers' infrastructure uses, which defenders can search their own traffic for.
A fix exists, and it was published the same day as the disclosure. Vates released corrected xo-server packages on November 10: version 5.213.1 for the latest channel and 5.211.2 for the stable channel. Press reports disagree on the Xen Orchestra version numbers — some cite 6.9.1 and 6.10.0, others 6.9.2 and 6.10.1 — so the xo-server package numbers are the ones to use, because they agree across sources. A separate advisory, VSA-2026-063, on VM-import permissions had no complete fix as of November 10, so that second issue remains open even for patched systems.
No password, no log entry, full admin — an empty cookie is all it takes.
Why It Matters
This matters because of what Xen Orchestra controls. It is the management console for XCP-ng virtualisation pools — the control room for the virtual machines that run a company's servers. An attacker with Admin privilege there does not just get into one machine; they get the console that manages all of them, with potential compromise of the managed hosts underneath. Virtualisation is infrastructure: it sits below the applications, so a compromise there is deeper and harder to clean up than a compromise in a single app.
It also matters because of how the flaw works. There is no password to guess, no phishing email to click, no file to open. The attacker simply sends a cookie containing an empty JSON object — a piece of data that should mean nothing — and the system treats it as a valid login. That is a failure in the most basic part of the software: checking who you are. And because a successful exploit leaves no log entry, the usual way of finding out you were attacked — reading the logs — does not work. Defenders have to check their network traffic against the published indicators instead, which is harder and slower.
For the market, the read-through is Broadcom, the virtualisation peer that owns VMware, because Vates is private and has no ticker of its own. The Bearish verdict is about the flaw, not about Broadcom's business: an actively exploited critical bypass in infrastructure-management software, with no CVE to track it and no log to detect it, is a negative event for the whole virtualisation ecosystem. The fix exists and was published the same day, which is the good news — but the bad news is that exploitation was already under way before the disclosure, and the people who do not yet know they need the fix are the ones most at risk.
Analyst's Take
Our call is Bearish. This is a critical flaw that is already being exploited, it needs no password, it gives full Admin privilege over the console that manages virtualisation pools, and it leaves no log entry — so victims may not even know they were hit. That combination is about as bad as a vulnerability gets. The fix is available, which limits the damage, but a fix only helps the people who install it, and the missing CVE and the silent exploitation mean many of them may not know they need to.
What to watch: whether Vates assigns a CVE and CVSS score, which will help defenders track and prioritise the flaw; whether the VSA-2026-063 VM-import issue gets a complete fix; and whether more victims surface once teams start checking their traffic against the published indicators. For anyone running Xen Orchestra, the step is simple and urgent: install xo-server 5.213.1 or 5.211.2, and check whether your systems ever talked to the published command-and-control address. Vates also recommends restricting access to Xen Orchestra management services — avoid direct internet exposure and keep admin interfaces on dedicated management networks — since patching alone does not prove an exposed console was never compromised. Broadcom is the read-through ticker here as the virtualisation peer that owns VMware; Vates itself is private.
Are you bullish or bearish on this story?
By The Numbers
FAQ
What is Xen Orchestra?
Xen Orchestra is the management console for XCP-ng, an open-source virtualisation platform — software that runs many virtual computers on a smaller number of physical servers. The console is where administrators control those virtual machines, so whoever controls the console can reach the machines it manages.
How does the flaw work?
The flaw is in how the REST interface — the part of the software other programs talk to — handles the authenticationToken cookie, the small token a browser sends to prove you are logged in. A cookie value of an empty JSON object, written as j:%7B%7D, is accepted during authentication, letting an unauthenticated attacker act with Admin privilege. A JSON object is a standard way of packaging data; an empty one should mean nothing, but here it was treated as a valid login.
What can an attacker do with it?
Act with Admin privilege on the console that manages XCP-ng virtualisation pools, with potential compromise of the managed hosts — the physical servers running the virtual machines. That is about as much access as the software can give.
Is there a fix?
Yes. Vates published corrected xo-server packages on November 10: version 5.213.1 for the latest channel and 5.211.2 for the stable channel. Press reports disagree on the Xen Orchestra version numbers, so use the xo-server package numbers. A separate advisory, VSA-2026-063, on VM-import permissions had no complete fix as of November 10.
Why is this especially dangerous?
Because it is actively exploited, it needs no password at all, and Vates warned a successful exploit leaves no log entry of the unauthenticated access — so a victim may not know they were hit. Vates published indicators including a command-and-control address, 91.211.251.112:8001, and a Tor onion service on port 3333 (ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion:3333), so defenders can check whether their systems talked to them.
👁
Source: Cyber Insider