Vates issues emergency Xen Orchestra patch for exploited auth bypass
Vates says the critical flaw allows admin access and code execution, and that fixed builds 6.9.2 and 6.10.1 are now available.
Vates released an emergency update for Xen Orchestra on November 10 after confirming that an authentication bypass vulnerability rated critical has been exploited in real attacks. The company published the details in security advisory VSA-2026-062, as reported by dailysecu.com.
The flaw lies in how the management server verifies login tokens. An attacker who bypasses authentication and gains admin rights can run arbitrary code in the managed virtualization environment and take root on connected XCP-ng hosts.
The vulnerability affects Xen Orchestra and Xen Orchestra Appliance (XOA). Fixed versions are 6.9.2 on the stable channel and 6.10.1 on the latest channel.
Detection and containment advice
Vates recommends blocking internet exposure of the management console and isolating it on a dedicated management network. Because an authentication bypass may leave no trace in Xen Orchestra logs, connected XCP-ng hosts should also be checked for signs of compromise.
If a compromise is confirmed, Vates advises rotating the credentials of linked systems such as backups and storage and reinstalling the system.
Quick answers
What versions of Xen Orchestra fix the vulnerability?
Fixed versions are 6.9.2 on the stable channel and 6.10.1 on the latest channel.
Which products are affected?
Xen Orchestra and Xen Orchestra Appliance (XOA).
Has the flaw been exploited?
Yes. Vates said the authentication bypass has been exploited in real attacks.