A critical, actively exploited bug in Xen Orchestra lets attackers skip the login screen entirely and take root control of your virtual servers — without leaving a trace in the logs.
If your business or IT provider runs virtual machines on XCP-ng through Xen Orchestra, there's a serious problem that needs attention right now, not next week. On 10 November 2026, the software maker Vates published security advisory VSA-2026-062, describing a critical authentication bypass that is already being exploited in the wild.
What's actually broken
Xen Orchestra is a popular management console for Xen/XCP-ng virtualization — the kind of self-hosted infrastructure many Swiss SMEs and smaller IT providers choose precisely because it's cheaper than commercial alternatives like VMware. That cost advantage is exactly why this flaw matters so much: a lot of real business infrastructure runs on it.
According to BleepingComputer's reporting, the issue comes down to how Xen Orchestra checks authentication cookies sent through its REST API. By sending a specially crafted cookie containing nothing more than an empty JSON object, an attacker can walk straight past the login screen — no username, no password, no MFA to beat.
Once inside, the attacker doesn't get a limited guest view. Vates confirms the attacker gains full Admin privilege, can execute arbitrary code across every managed pool, and can fully take over an XCP-ng node as root. In plain terms: every virtual machine, every workload, every piece of data sitting on that infrastructure is exposed.
Why this one is especially dangerous
Two things set this apart from a typical "patch it and move on" bug. First, it's already being actively exploited — this isn't a theoretical risk, it's happening now. Second, and more worrying: a successful attack does not generate the standard log entries administrators would normally rely on to spot an intrusion. That means a server could already be compromised without any obvious sign in the usual places you'd look.
Because of this, Vates is telling administrators not to just patch and assume they're safe. The advisory recommends actively monitoring HTTP traffic for the malicious cookie pattern and watching for known indicators of compromise, including suspicious IP addresses and onion (Tor) domains, as reported by SC World.
What to do today
- Update immediately. The fix is included in Xen Orchestra versions 6.10.1 and 6.9.2, released as of 10 November 2026. No CVE or CVSS score has been assigned yet, but "no score" does not mean "low risk" — Vates itself rates this critical.
- Assume compromise is possible, not just the bug. Patching closes the door, but it doesn't undo anything an attacker may have already done. Check your access logs and any available HTTP traffic logs for the suspicious cookie pattern described above.
- If you suspect compromise, rotate everything. Vates' advisory specifically recommends resetting all passwords and secrets tied to the platform: proxy credentials, backup remotes (NFS, S3, Azure, SMB), the root account, pool secret, individual user accounts, OTP secrets, and mail server configuration passwords. A partial reset leaves a backdoor open.
- Restrict access to the management interface. If Xen Orchestra or XOA is reachable from the open internet, put it behind a VPN or IP allow-list while you confirm the patch and run through the checks above.
- Ask your IT provider directly. If you don't manage your own virtualization infrastructure, ask whoever does: "Are we running Xen Orchestra or XCP-ng, and have we applied VSA-2026-062?" Don't assume it's been handled — ask for confirmation in writing.
The bigger picture
This is the latest in a steady run of critical, actively exploited flaws hitting business-critical infrastructure — from VPNs to NAS boxes to now virtualization platforms. The pattern is clear: attackers are moving faster than patch cycles, and "we'll get to it next sprint" is no longer a safe answer. Keeping track of which systems need attention, and actually applying fixes before attackers find you, is quickly becoming a full-time job.
This is exactly the kind of day-to-day vigilance that The Mejlerö Company (Flitz.ai) helps Swiss SMEs with — monitoring infrastructure, applying security basics like two-factor authentication and endpoint protection, and making sure critical updates don't fall through the cracks. If you're not sure what's running in your environment or who's watching it, a free network analysis is a good place to start. We'll keep tracking stories like this one and reporting what actually needs doing, this week.
Switzerland.