Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers

French virtualization management software vendor Vates issued emergency security fixes to resolve an actively exploited authentication bypass vulnerability affecting its Xen Orchestra platform. As reported in BleepingComputer's report, remote adversaries with network access to exposed management interfaces are leveraging the flaw to gain administrative control and hijack downstream XCP-ng virtualization servers.

This technical briefing examines the mechanics of the authentication bypass, the privilege escalation path across hypervisor clusters, available software patches, and host verification procedures. It is designed for infrastructure engineers, virtualization administrators, and security teams responsible for maintaining and defending enterprise XCP-ng compute environments.

01Empty JSON object cookie manipulation

The core weakness stems from how the Xen Orchestra application server parses session authentication data delivered across web requests. When processing authentication cookies sent to the platform, the backend fails to validate the structure of the incoming session payload. Attackers exploit this logic breakdown by transmitting a crafted cookie formatted as authenticationToken=j:%7B%7D, which supplies an empty JSON object instead of a valid token string.

Upon receiving the malformed JSON structure, the application retrieves an existing valid authentication token from memory rather than rejecting the request. The service then authenticates the incoming HTTP connection as the owner of that retrieved token without prompting for user credentials. This behavioral breakdown permits full identity assumption across the management layer while bypassing standard credential validation routines entirely.

Following the initial bypass, the adversary queries the /rest/v0/users/me/authentication_tokens REST API endpoint to extract reusable login token identifiers. These harvested identifiers allow the threat actor to maintain continuous, authenticated access to the management environment. The flaw was identified by security researchers Filip Magic and Christoffer Olsen of TDC NET Security and is tracked under internal tracking identifier VSA-2026-062 without an assigned CVE designation or CVSS rating.

02Administrative elevation and host root compromise

Once access to the web interface is established, the adversary inherits administrative authority across all registered assets. Xen Orchestra serves as the centralized control layer for XCP-ng deployments, coordinating compute pools, virtual machine instances, and underlying hypervisor nodes. Gaining unauthorized control of this centralized control plane grants immediate command reach over the entire operational virtualization architecture.

The vendor issued a severe advisory regarding the blast radius of successful intrusion, noting that an adversary can bypass authentication and perform actions with Admin privilege. Compromising the management portal directly facilitates arbitrary code execution across managed pools and exposes the underlying XCP-ng virtualization host to full root takeover. This compromise effectively eliminates the boundary between guest virtualization workloads and host hypervisors.

Because the software directly issues orchestration commands to physical server nodes, full control over the central web interface enables hypervisor manipulation. Threat actors can alter virtual hardware settings, access host storage volumes, and intercept virtual machine communications. Organizations relying on default administrative boundaries face comprehensive environment compromise once an attacker exploits the initial management console bypass.

03Patched releases and network boundary controls

To resolve the vulnerability, Vates released updated software packages across its supported release channels. The vendor deployed Xen Orchestra 6.9.1 for administrators tracking the stable branch alongside Xen Orchestra 6.10.0 for those running the latest release tier. The core fix is packaged within patched xo-server component releases, specifically version 5.211.2 for stable systems and version 5.213.1 for current installations.

The vulnerability impacts both custom Xen Orchestra source installations and prebuilt Xen Orchestra Appliance virtual deployments. System operators are advised to apply the upgraded xo-server packages immediately across all running instances to eliminate the cookie parsing defect. Applying the distribution updates immediately closes the vulnerable REST API processing pipeline and prevents unauthorized session retrieval.

For operations teams unable to deploy software updates immediately, network segmentation serves as the essential temporary mitigation. Administrators should isolate Xen Orchestra management endpoints from external visibility and restrict ingress traffic strictly to dedicated, private management networks. Furthermore, boundary security appliances should block traffic originating from known malicious internet protocol addresses associated with active exploitation campaigns.

04Node inspection commands and filesystem artifacts

Security investigations into observed intrusions revealed a series of distinct operational footprints left across compromised virtualization infrastructure. Threat actors have been observed creating a virtual machine labeled pivot2 to establish internal footholds within target pools. Additionally, the attackers alter virtual machine configurations by attaching the specific hypervisor parameter hvm_serial: file to direct serial output to local files.

System administrators can audit their XCP-ng physical hosts directly by executing specific command-line utilities against the management toolstack. Running xe vm-list params=name-label,platform alongside grep filters isolates instances carrying the unauthorized serial file configuration. In addition, executing zgrep across compressed xensource log files identifies historical instances where the serial file parameter was invoked during runtime execution.

Attackers also establish persistence by deploying unauthorized scheduled cron jobs and filesystem payloads across host directories. Investigators should run directory listings against dynamic library preload configurations and root storage paths to detect unauthorized files such as /etc/cron.d/zz-ustar, /etc/cron.d/zz-ustar2, /.ustar5, and /.ustar6. Locating any of these specific filenames confirms active post-exploitation tampering on the inspected server.

05Threat infrastructure and logging visibility gaps

Telemetry linked to the ongoing intrusion campaign associates attacker command channels with external hosting infrastructure and specialized darknet routing services. Outbound and inbound traffic includes direct connections to internet protocol address 91.211.251.112 on port 8001. Attackers also utilize an onion service endpoint, specifically ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion operating across port 3333, to route operational traffic.

Detecting intrusion attempts requires active monitoring at the HTTP network layer rather than relying on standard application logging. Vates cautioned that active exploitation attempts fail to record specific identifying markers within standard local logs, meaning the crafted cookie payload leaves no local trace. Network defense appliances and reverse proxies must actively inspect incoming HTTP headers for authenticationToken=j:%7B%7D or authenticationToken=j:{} strings.

The vendor highlighted that the released forensic indicators originate from one specific attack cluster, meaning other threat actors may adopt alternative tooling. Any organization discovering evidence of intrusion must treat existing administrative credentials as compromised. In addition to applying the xo-server patch, operations teams must immediately rotate all administrative passwords, API keys, and environment secrets across their virtualization infrastructure.