Vates advisory VSA-2026-062 published November 10, 2026; operator coverage November 11, 2026
An Empty Cookie Walks In as Admin: Xen Orchestra Bypass Is Exploited and Leaves Nothing in the Logs
The smallest bug in this edition may be the most instructive. Vates advisory VSA-2026-062, published November 10, describes a critical authentication bypass in Xen Orchestra, the web console that manages XCP-ng virtualization pools: the REST authentication code reads the authenticationToken cookie, the parser turns the value for an empty JSON object into that object instead of a string, and the token lookup returns its first stored token, signing the attacker in as that token owner with no password at all. From an admin session the attacker can pull reusable token IDs, and Vates states that compromise can lead to arbitrary code execution on managed pools and a full XCP-ng node takeover as root. The flaw was found by Filip Magic and Christoffer Olsen of TDC NET Security, the fix landed the same day, and Vates confirms active exploitation, publishing campaign indicators that include a rogue virtual machine named pivot2, cron files named zz-ustar and zz-ustar2, files named /.ustar5 and /.ustar6, a modified /etc/ld.so.preload, and command traffic tied to the address 91.211.251.112 on port 8001 and a Tor onion service. Two properties make the hunt harder than the patch: the crafted cookie does not appear in Xen Orchestra own logs, so absence in the application log proves nothing, and Vates advises that a confirmed compromise calls for reinstallation rather than cleanup. No CVE number or CVSS score had been assigned at disclosure. The fixed code ships in xo-server 5.211.2 on the stable line and 5.213.1 on the latest line, carried by Xen Orchestra 6.9.1 and 6.10.0 respectively, with later point releases already listed in operator coverage, so the version check that matters is the xo-server build.
Executives
A virtualization console is the keys to every server it manages, and this one opened to a cookie containing nothing. The executive facts are three: the flaw is confirmed exploited, it leaves no trace in the product own logs, and the vendor remedy for a confirmed hit is to rebuild, not to clean. Ask whether any Xen Orchestra console in your estate was reachable from the internet or a broad internal network, and whether the hunt used network records and host checks rather than the application log. A clean log review, on this flaw, is not evidence.
CIO / CISO
Patch and hunt as one operation, in that order but without a gap. Confirm every console and appliance, including source-built installs, runs xo-server 5.211.2 or 5.213.1 or later, then hunt the published indicators on every host: the pivot2 virtual machine, the hvm_serial file platform parameter, the zz-ustar cron files, the /.ustar files and the ld.so.preload state, plus network captures for the empty-token cookie pattern. Rotate pool secrets, root and user passwords, one-time-password secrets and backup remote credentials wherever compromise is possible, and hold the management network boundary as a permanent control, not an incident measure.
Engineers
Update first, then verify the xo-server build on the running service. Detection lives outside the app: watch live HTTP traffic for authenticationToken values carrying the empty JSON object, in either encoded or plain form, with packet capture or a reverse proxy log. On hosts, list virtual machines and platform parameters, inspect /etc/cron.d and the filesystem root for the indicator names, and diff /etc/ld.so.preload against a known-good state. Treat any indicator hit as a confirmed incident and follow the vendor line: reinstall the host rather than removing the artifacts you found.
Everyone (non-IT)
Most staff will never touch this console, and there is nothing to install or click. If you help run a small virtualization setup at work, the useful act is passing one sentence to whoever owns it: the Xen Orchestra flaw has no CVE number yet, so it will not arrive through the usual scanner alert, and the vendor advisory VSA-2026-062 is the document to work from. Do not wait for a tracking number to treat a vendor-confirmed, actively exploited bypass as urgent.