Facts checked Nov 10, 2026
Vates says in advisory VSA-2026-062 that a threat actor is actively exploiting Xen Orchestra, and that anyone who can reach it can act as Admin with no login trace. Cut its network exposure and update today, then check the hosts, because login history will not show an intrusion.
What happened
The advisory, published Nov. 10, 2026, rates the impact Critical on Vates' own scale. The CVSS 4.0 field reads "Not available yet", and as of Nov. 10 at 17:25 UTC the advisory lists no CVE.
According to Vates, the REST interface passes the authentication token cookie to the token provider without requiring a string. If the cookie holds an empty object, the token collection treats it as an unfiltered lookup and returns its first token, and the provider authenticates the caller as that token's owner if it is unexpired. A second, authenticated route then returns reusable login token IDs. Vates says an attacker can "perform actions with 'Admin' privilege" and that a Xen Orchestra compromise "can lead to arbitrary code execution on managed pools and a full XCP-ng node takeover as root". The advisory does not say root was reached on any victim.
The advisory names attacker infrastructure: 91.211.251[.]112 on port 8001 and the Tor onion service ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid[.]onion on port 3333. Filip Magic and Christoffer Olsen of TDC NET Security found the flaw.
Who is affected
Xen Orchestra and the Xen Orchestra Appliance. The advisory's affected line reads "xo-server before 5.213.1 and 5.213.2 in Xen Orchestra before 6.9.1 (stable) and 6.10.0 (latest)". Its resolution lists xo-server 5.213.1 on latest and 5.211.2 on stable.
The advisory says Xen Orchestra 6.10.0 and 6.9.1 "has been updated and includes the fix", but Vates' forum announcement tells appliance users to update to 6.10.1 on latest or 6.9.2 on stable. Vates' changelog shows 6.10.0 and 6.9.1 first shipped xo-server 5.213.0 and 5.211.1, both older than the fixed builds, so check the xo-server build, not the Xen Orchestra number. We read "5.213.2" in the affected line as a typo for 5.211.2; Vates has not confirmed that.
What to do now
- Network team, today: take Xen Orchestra off the internet and onto a dedicated management network, as Vates lists first. Block 91.211.251[.]112 and Tor traffic to the listed onion service, inbound and outbound.
- Virtualization admins, today: update (appliance: 6.10.1 on latest or 6.9.2 on stable, per Vates' forum post; from sources: latest master, then rebuild and restart xo-server), then read the installed xo-server build: 5.213.1 or later on the latest channel, 5.211.2 or later on stable. A WAF or reverse-proxy rule for the empty token is only a stopgap: Vates warns it can be bypassed using other formats. The advisory has the match strings.
- SOC, this week: Vates says there is no log to detect unauthenticated access, but says the exploit can be detected by monitoring HTTP requests (tcpdump or Wireshark). In Xen Orchestra, look for a running VM named pivot2. On each XCP-ng host, check for VMs whose platform parameters set hvm_serial to a file, search xensource.log and its rotations for the string -serial file:, and look for /etc/cron.d/zz-ustar, /etc/cron.d/zz-ustar2, /.ustar5, /.ustar6 and /etc/ld.so.preload. Vates says these checks only cover this specific campaign and that other actors with different tooling and infrastructure cannot be ruled out.
- Security lead, this week: if Xen Orchestra was reachable by an attacker at any point, revoke all active sessions and API tokens, then rotate the secrets used in your stack: the root password of every XCP-ng host, XO proxy credentials, backup remotes such as NFS and S3, and XO user passwords and OTP secrets. Vates' forum post lists these steps; the advisory ties rotation to Xen Orchestra having "been compromised". We apply them to any instance an attacker could reach because, with no log entry and checks that cannot prove a negative, you cannot establish that it was not compromised.
What is not known yet
Vates does not say how many organizations were hit, when exploitation began or how targets were found, so you cannot rule yourself out by date. As of Nov. 10, CISA's Known Exploited Vulnerabilities feed (dated Nov. 9) has no Xen Orchestra entry, and the advisory may gain more indicators.
