Interfaz en español. Las fichas, los resúmenes y las fuentes conservan su idioma original.
Xen Orchestra · Xen Orchestra Appliance
Aviso de seguridad
Vates confirms exploitation of VSA-2026-062 and abuse of the VSA-2026-063 import path with administrator privileges. The published 6.9.2 and 6.10.1 fixes address only VSA-2026-062.
Quiénes deben revisar: Teams administering Xen Orchestra or Xen Orchestra Appliance and the XCP-ng pools they manage.
Update the affected Xen Orchestra branch, isolate management access and restrict imports to administrators. Apply the separate permission restrictions for VSA-2026-063, which remains unpatched.
¿Cuál es la vulnerabilidad y su impacto?
VSA-2026-062 allows an attacker to bypass authentication through token handling. Vates reports active exploitation and warns that compromise can extend from Xen Orchestra to managed pools and root access on XCP-ng hosts.
The corrections are Xen Orchestra 6.9.2 stable and 6.10.1 latest, containing xo-server 5.211.2 and 5.213.1 respectively. They address VSA-2026-062 only.
VSA-2026-063 is separate: import and network privileges can permit crafted VM data to reach XAPI with pool administrator authority. The reviewed advisory still lists 6.10.1 and earlier as affected with no patch in either channel. Vates instructs operators to restrict imports to administrators and disable users with the named import or network permissions.
Observed abuse of this second path used administrator privileges obtained through VSA-2026-062. The possible path for users with lower privileges is distinct from that observed activity; it is not confirmed exploitation by those users.
Investigate prior access and managed hosts as well as installing fixes. The vendor’s indicators cover the observed campaign, not every possible attacker. For confirmed compromise, Vates recommends full reinstallation and rotation of passwords and secrets; patching does not establish that persistence has been removed.
- Proveedor / autor
- Vates
- Acceso necesario
- Depende de la aplicación o configuración
- Divulgado
- 10 nov 2026
- Última revisión de evidencia
- 12 nov 2026 UTC
¿Qué sistemas y versiones están afectados?
| Producto | Afectado | Versión corregida / acción |
|---|---|---|
| VSA-2026-062: Xen Orchestra stable | Versions before 6.9.2; Xen Orchestra Appliance is affected. | 6.9.2 stable; xo-server 5.211.2. This correction addresses VSA-2026-062 only. |
| VSA-2026-062: Xen Orchestra latest | Versions before 6.10.1; Xen Orchestra Appliance is affected. | 6.10.1 latest; xo-server 5.213.1. Vates advises installations built from source to update to current master. |
| VSA-2026-063: Xen Orchestra and Appliance | 6.10.1 and earlier, including the releases correcting VSA-2026-062. | No fix is listed in stable or latest in the reviewed advisory. Allow VM import only to administrators and disable users with the permissions identified by Vates. |
Usá las indicaciones para tu producto y rama. Confirmá con el proveedor las correcciones adaptadas a tu distribución; el nombre del producto por sí solo no establece exposición.
¿Qué se sabe de la explotación?
Ataques observados
Fundamento de la prioridad
Vates confirms active exploitation of the authentication bypass and abuse of imports with administrator privileges. Patching VSA-2026-062 does not resolve VSA-2026-063; prior compromise requires investigation.
¿Qué implica para los entornos de IA?
Review service accounts and automation with import or network privileges alongside human administrators.
Fuentes de este aviso
- VSA-2026-062: authentication bypass, active exploitation and correctionsVates · Revisado 12 nov 2026 UTC
- VSA-2026-063: import permissions, observed administrator abuse and mitigationVates · Revisado 12 nov 2026 UTC
Historial editorial1 entrada
Added verified vendor scope, response actions and the limits of the available evidence.
Prepará tu respuesta
Usá esta lista para evaluar si el aviso afecta a tus sistemas, registrar las acciones de tu equipo y compartir el resultado. Radar no escanea ni verifica tu entorno.
Los cambios se guardan automáticamente en este navegador. No se sincronizan con tu equipo ni se envían a Oktsec.
1. Evaluá si aplica a tu entorno
Revisá los sistemas y versiones afectados y registrá tu decisión a continuación. Si tenés dudas, elegí «Requiere verificación».
2. Registrá la respuesta
Indicá el sistema y la persona o equipo responsable. Actualizá cada acción y agregá una referencia al ticket o notas sobre lo revisado.
Update the matching branch
Install 6.9.2 stable or 6.10.1 latest, with the corresponding xo-server correction. Verify the running version. These fixes do not resolve the separate import vulnerability.
Agregar evidencia o notas
Usá solo referencias. No guardes credenciales ni datos confidenciales acá.Restrict import and network privileges
For VSA-2026-063, Vates says to allow imports only to Admin users and disable users configured with vm.import, sr/import:vm, network/action:create or network/action:update. Review human and service accounts.
Agregar evidencia o notas
Usá solo referencias. No guardes credenciales ni datos confidenciales acá.Isolate management access
Remove public Internet exposure and place Xen Orchestra on a dedicated management network. Follow the vendor’s current containment guidance; blocking the listed indicators alone is not proof of safety.
Agregar evidencia o notas
Usá solo referencias. No guardes credenciales ni datos confidenciales acá.Investigate prior access and managed hosts
Review the vendor’s campaign indicators on Xen Orchestra and XCP-ng hosts. Successful unauthenticated access may leave no application login record. Absence of the published indicators does not establish absence of compromise.
Agregar evidencia o notas
Usá solo referencias. No guardes credenciales ni datos confidenciales acá.Recover after confirmed compromise
Vates recommends full reinstallation after confirmed compromise and rotation of VMS passwords and secrets, including pool, root, backup, user and OTP credentials. A version update alone does not remove persistence.
Agregar evidencia o notas
Usá solo referencias. No guardes credenciales ni datos confidenciales acá.
3. Compartí el plan
Descargá un archivo Markdown con tu decisión, los estados de las acciones, las notas y las fuentes. Compartilo con tu equipo o adjuntalo a un ticket.
Sistemas afectados y correcciones
Compará la versión en ejecución y la configuración con las indicaciones del proveedor.
| Producto | Afectado | Versión corregida / acción |
|---|---|---|
| VSA-2026-062: Xen Orchestra stable | Versions before 6.9.2; Xen Orchestra Appliance is affected. | 6.9.2 stable; xo-server 5.211.2. This correction addresses VSA-2026-062 only. |
| VSA-2026-062: Xen Orchestra latest | Versions before 6.10.1; Xen Orchestra Appliance is affected. | 6.10.1 latest; xo-server 5.213.1. Vates advises installations built from source to update to current master. |
| VSA-2026-063: Xen Orchestra and Appliance | 6.10.1 and earlier, including the releases correcting VSA-2026-062. | No fix is listed in stable or latest in the reviewed advisory. Allow VM import only to administrators and disable users with the permissions identified by Vates. |
Confirmá con el proveedor las correcciones adaptadas a tu distribución. Coincidir en el producto no basta para establecer exposición.
Evidencia y fuentes
Por qué tiene esta prioridad
Vates confirms active exploitation of the authentication bypass and abuse of imports with administrator privileges. Patching VSA-2026-062 does not resolve VSA-2026-063; prior compromise requires investigation.
Criterios de prioridadFuentes
Los datos técnicos provienen de estas fuentes. Las prioridades y las acciones recomendadas son el análisis de Oktsec.
- VSA-2026-062: authentication bypass, active exploitation and correctionsVates · Aviso del proveedor · Revisado 12 nov 2026 UTC
- VSA-2026-063: import permissions, observed administrator abuse and mitigationVates · Aviso del proveedor · Revisado 12 nov 2026 UTC
Registro técnicoProductos, identificadores y detalles de respaldo
| Producto / servicio | Xen Orchestra, Xen Orchestra ApplianceVates |
|---|---|
| Evidencia de explotación | Ataques confirmados |
| Acceso necesario | Depende de la aplicación o configuración |
| Corrección / respuesta | Requiere acciones adicionalesVersiones afectadas y correcciones |
- Divulgado
- 10 nov 2026
- Registro revisado
- 12 nov 2026 UTC
Para entornos con agentes de IA
Review service accounts and automation with import or network privileges alongside human administrators.