Critical Xen Orchestra Authentication Bypass Exploited in the Wild to Seize Admin Access

French virtualization software vendor Vates VMS has issued an urgent alert warning that a critical authentication bypass vulnerability in Xen Orchestra is being actively exploited in the wild. The flaw, currently tracked as VSA-2026-062, does not yet have a CVE identifier assigned, meaning defenders relying solely on CVE-driven patch management may be blind to it.

Xen Orchestra is the web-based management interface for the Xen hypervisor ecosystem, widely deployed by organizations running Vates' XCP-ng platform and related virtualization infrastructure. Because the interface sits at the administrative heart of a virtual estate, a successful bypass grants attackers a direct path to hypervisor-level control.

How the Bypass Works

According to the vendor's advisory, the root cause lies in how the REST API handles authentication cookies. Vates VMS described the mechanism succinctly: the parsing logic converts the string authenticationToken=j:%7B%7D into an empty object, {}. That empty object is then passed into the REST authentication routine, which treats it as a valid — if unprivileged — identity rather than rejecting it outright.

In practical terms, an attacker who can craft a malicious cookie can slip past authentication checks without valid credentials. The vendor's alert indicates that the resulting access can be leveraged to obtain administrative privileges over the Xen Orchestra instance.

This class of bug — where a deserialization or type-confusion weakness causes an authentication token to collapse into a default or empty value — is a recurring theme in web application security. When the authentication layer fails open rather than closed, the consequences are typically severe.

Why This Matters for Virtualization Admins

Xen Orchestra is not a peripheral tool. It provides centralized management for pools of Xen hosts, virtual machines, storage repositories, and backups. An attacker with admin access to the orchestrator can, in principle, manipulate VM lifecycle operations, access console sessions, alter backup configurations, and pivot deeper into the environment. Virtualization management planes have become a favored target for ransomware operators and espionage groups precisely because compromising them yields control over many downstream workloads at once.

The absence of a CVE is a notable wrinkle. Attackers and defenders alike can track VSA-2026-062 through the vendor's own advisory channel, but vulnerability scanners, threat intelligence feeds, and CISA's Known Exploited Vulnerabilities catalog typically key off CVE identifiers. Organizations that depend on automated CVE matching should manually verify their exposure.

Recommended Actions

Vates VMS has published guidance alongside the alert, and administrators are strongly advised to apply the vendor's fix immediately. In the interim, defenders should consider the following measures:

  • Patch without delay. Treat VSA-2026-062 as an emergency change. Given confirmed in-the-wild exploitation, standard patch windows are inappropriate.
  • Restrict exposure. Xen Orchestra's web interface should never be reachable from the public internet without a VPN, zero-trust proxy, or equivalent access control in front of it. Audit any instances currently exposed.
  • Hunt for indicators. Review web server and application logs for anomalous requests containing crafted authenticationToken cookie values, particularly those with URL-encoded JSON fragments such as %7B%7D. Look for authentication events that succeeded without a corresponding legitimate login.
  • Check for persistence. Assume that any instance exploited before patching may have rogue administrative accounts, modified API tokens, or altered configuration. Rotate credentials and API keys after remediation.
  • Monitor downstream systems. Because orchestrator access can translate into hypervisor-level control, review VM and host activity for unexpected changes.

The Broader Pattern

This incident fits a well-established pattern in which virtualization and infrastructure management platforms become high-value targets. Authentication bypasses in management consoles are especially dangerous because they often require no user interaction and leave minimal forensic footprints if logging is not tuned to capture malformed authentication attempts.

The lack of a CVE also highlights a structural gap: vendors sometimes disclose and patch faster than the CVE assignment process can keep pace, leaving a window where exploitation is confirmed but automated defenses remain unaware. Security teams should maintain subscriptions to vendor-specific advisory feeds for critical infrastructure software, not just national vulnerability databases.

For organizations running Xen Orchestra in production, the message is unambiguous: verify your version, patch now, and investigate whether your instance has already been touched.

Source: The Hacker News — Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access