Vates confirms attackers are exploiting a critical Xen Orchestra flaw to take over virtual servers

French company Vates published security advisory VSA-2026-062 on November 10 about a critical-severity flaw in Xen Orchestra, its web platform for managing XCP-ng virtualization environments, and in Xen Orchestra Appliance. According to the advisory, the vulnerability is being actively exploited by an attacker.

According to Vates, the flaw makes it possible to bypass authentication with a manipulated cookie and act with administrator privileges. The company warns that compromising Xen Orchestra can lead to code execution on the managed server pools and to full takeover of an XCP-ng node as the root user.

Vates has released the fixed versions Xen Orchestra 6.9.1 (stable) and 6.10.0 (latest) and recommends updating as soon as possible. In the meantime, it advises not exposing Xen Orchestra to the internet, placing it on a dedicated management network and blocking the attacker infrastructure it has identified. If compromise is suspected, it asks for all passwords and secrets in the environment to be changed, because it does not rule out theft of configuration and credentials.

According to Vates, exploitation leaves no trace in the logs and can only be detected by monitoring HTTP traffic. The company says its indicators of compromise correspond to the campaign identified so far and that other attackers using the flaw in a different way cannot be ruled out. The advisory does not yet have a CVE identifier or a severity score, according to BleepingComputer. No information has been given on how many organizations have been affected.