Follow-up coverage published November 12, 2026; Vates advisories VSA-2026-062 and VSA-2026-063 published November 10, 2026
Patched Is Not Finished: Xen Orchestra Second Advisory Still Has No Complete Fix
The follow-up reporting on the Xen Orchestra bypass adds the detail that changes the patch plan: fixing the exploited flaw does not finish the advisory set. Vates advisory VSA-2026-062, published November 10, describes the critical authentication bypass in the REST interface handling of the authenticationToken cookie: a cookie value holding an empty JSON object, written as j:%7B%7D, is accepted and returns the first unexpired login token, letting an unauthenticated attacker act with Admin privilege on the console that manages XCP-ng virtualization pools, with potential compromise of the managed hosts. Vates confirms active exploitation, and a successful exploit leaves no log entry of the unauthenticated access in the product own logs. The published indicators include the command and control address 91.211.251.112 on port 8001 and a Tor onion service on port 3333. The fix shipped the same day in xo-server 5.213.1 on the latest channel and 5.211.2 on the stable channel; press reports disagree on the Xen Orchestra release numbers, citing 6.9.1 and 6.10.0 in some coverage and 6.9.2 and 6.10.1 in other coverage, so the xo-server package numbers are the reliable check. The open item is the separate advisory VSA-2026-063, covering VM-import permissions, which had no complete fix as of November 10 and therefore remains open even on systems that applied the bypass fix on day one. No CVE identifier or CVSS score had been assigned to the bypass at disclosure, which is why this flaw does not arrive through the usual scanner and catalog channels.
Executives
Hold two separate statuses for this product, not one. The exploited bypass has a fix and a version check; the VM-import advisory does not have a complete fix yet, so a fully patched estate still carries a named open item. Ask for both answers in writing: the xo-server build on every console, and the compensating controls standing in for the unfinished fix, with the management network boundary named. A single green patch report would hide exactly the item that matters.
CIO / CISO
Keep the hunt pointed outside the application log, because the vendor states the exploit writes nothing there: network records for the published command and control address and the Tor endpoint, host checks for unexpected virtual machines and changed platform parameters, and live traffic inspection for the empty-object cookie pattern. Track VSA-2026-063 as an open exposure with an owner until Vates publishes a complete fix, and treat the absence of a CVE as a tracking problem to solve manually, since automated tooling keyed to CVE identifiers will not surface either advisory.
Engineers
Confirm the running xo-server build reads 5.213.1 or 5.211.2 or later on every console and appliance, including source-built installs, rather than trusting the Xen Orchestra release label. Restrict management services to a dedicated management network with no direct internet exposure, as the vendor recommends, and record that restriction as the standing control for the open VM-import item. Where any indicator matches, follow the vendor position from the original advisory: reinstall rather than clean.
Everyone (non-IT)
If you help administer a small virtualization setup, pass one sentence to whoever owns it: the tracking number for this flaw does not exist yet, so it will not arrive as a scanner alert, and the document to work from is Vates advisory VSA-2026-062, with VSA-2026-063 still open behind it. Everyone else has nothing to install and nothing to click.