Critical Xen Orchestra Flaws Exploited in Attacks
Source SecurityWeek
Fixed in 6.10.1 : patch affected systems soon.
Data as of 11 Nov 2026, 15:48 UTC
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in 6.10.1, 6.9.2
What to do
AI-suggested
Vates recommends placing Xen Orchestra instances behind dedicated networks and blocking IP addresses and domain names associated with known malicious activity. Implement WAF rules to block the empty authentication token exploited in the attack. Rotate all potentially compromised credentials promptly. In case of confirmed compromise, a full reinstallation of the affected systems is advised, as cleanup alone cannot guarantee removal of all attacker backdoors. A fix for the authentication bypass is available in Xen Orchestra versions 6.9.2 (stable) and 6.10.1 (latest); upgrade to these versions to remediate the vulnerability.
Description
A critical authentication bypass vulnerability in Xen Orchestra allows unauthenticated attackers to gain administrator privileges and execute arbitrary code, leading to full takeover of XCP-ng nodes. The flaw exists in the REST authentication mechanism where an empty token is mishandled, exposing reusable login tokens. This vulnerability affects Xen Orchestra versions prior to 6.9.2 (stable) and 6.10.1 (latest), including the Xen Orchestra Appliance. A second vulnerability enabling malicious VM imports is also being exploited but remains unpatched. The vendor recommends network isolation, blocking malicious IPs and tokens, credential rotation, and full reinstallation if compromised.