Xen Orchestra: VSA-2026-062 takes XCP-ng as root
Vates says attackers are using critical flaw VSA-2026-062 to log into Xen Orchestra as an admin and take over XCP-ng hosts as root. Install 6.9.1 or 6.10.0, keep the console off the internet, and rotate every secret the orchestrator stored if it was reachable.
By ZeroDay Times Desk2 min read
![Editorial thumbnail for “Xen Orchestra: VSA-2026-062 takes XCP-ng as root”, shield graphic on a teal and coral columns card, [ ZERO-DAY ] badge, and the ZeroDay Times mark.](/images/articles/xen-orchestra-vsa-2026-062-xcp-ng-root.svg)
Vates published VSA-2026-062 on November 10, 2026, and rated it critical. A CVE number and a CVSS score are still unassigned. The flaw is an authentication bypass in Xen Orchestra, the web console Vates builds for XCP-ng pools, and in the Xen Orchestra Appliance. Anyone who can reach the management interface can act as an administrator without a valid login. From that session, Vates says a compromised console can run code on managed pools and take an XCP-ng node as root.
Vates says the bug is already in use. The campaign it has identified calls home to 91.211.251.112 and to a Tor service named in the advisory. Filip Magic and Christoffer Olsen of TDC NET Security are credited with the discovery. The fix on the stable channel is Xen Orchestra 6.9.1, with xo-server 5.211.2. The fix on the latest channel is Xen Orchestra 6.10.0, with xo-server 5.213.1.
What an admin session on the console is worth
Xen Orchestra is the control plane. It holds the inventory of virtual machines, the credentials for the hosts, and the paths to backup stores, proxies, and object storage. An admin session there is authority over the pool. A guest that looked isolated is then running on a hypervisor the attacker administers.
Vates says a successful bypass can leave no log line for the unauthenticated login itself. A quiet log is not a clean bill. The indicators in the advisory cover one campaign. Another actor can use the same bug from different infrastructure, and the absence of those indicators does not clear the host.
What to do today
Install 6.9.1 if you track stable, or 6.10.0 if you track latest, and confirm xo-server afterward: 5.211.2 on stable, 5.213.1 on latest. Appliance images take the same update. Read the version the console reports after it comes back.
Until that build is installed, keep Xen Orchestra off the internet and on a management network that ordinary users cannot route to. Block 91.211.251.112 in both directions, and block Tor traffic toward the service named in VSA-2026-062. Those blocks match the campaign Vates has described. The bug stays open on any older build.
If the console was reachable before the update, rotate the secrets it could see: root and user passwords, proxy credentials, backup credentials, and S3 keys. Vates says configuration theft and credential harvesting cannot be ruled out. Then search for the virtual machine name and the host files the advisory lists. A pool that shows none of those indicators can still have been touched. The update and the rotation are the steps that still count when the campaign in the log is a different one.
This briefing relies on public reporting by BleepingComputer and on Vates advisory VSA-2026-062. It does not include exploit procedures or proof-of-concept detail.
Corrections and tips:[email protected]