# Xen Orchestra: active exploitation requires patches and import restrictions Canonical: https://www.oktsec.com/radar/xen-orchestra-vsa-2026-062-063 Publisher: Oktsec Language: en Published: 2026-11-12T12:27:20Z Updated: 2026-11-12T12:27:20Z Record reviewed: 2026-11-12T12:27:20Z Latest evidence check: 2026-11-12T12:27:20Z Disclosed: 2026-11-10 Vates confirms exploitation of VSA-2026-062 and abuse of the VSA-2026-063 import path with administrator privileges. The published 6.9.2 and 6.10.1 fixes address only VSA-2026-062. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Act now - Rationale: Vates confirms active exploitation of the authentication bypass and abuse of imports with administrator privileges. Patching VSA-2026-062 does not resolve VSA-2026-063; prior compromise requires investigation. - Evidence: Attacks confirmed - Verification: Vendor confirmed - Fix status: Additional action required - Exposure requirement: Application or configuration dependent - Vendor: Vates - Products: Xen Orchestra, Xen Orchestra Appliance ## Technical overview VSA-2026-062 allows an attacker to bypass authentication through token handling. Vates reports active exploitation and warns that compromise can extend from Xen Orchestra to managed pools and root access on XCP-ng hosts. The corrections are Xen Orchestra 6.9.2 stable and 6.10.1 latest, containing xo-server 5.211.2 and 5.213.1 respectively. They address VSA-2026-062 only. VSA-2026-063 is separate: import and network privileges can permit crafted VM data to reach XAPI with pool administrator authority. The reviewed advisory still lists 6.10.1 and earlier as affected with no patch in either channel. Vates instructs operators to restrict imports to administrators and disable users with the named import or network permissions. Observed abuse of this second path used administrator privileges obtained through VSA-2026-062. The possible path for users with lower privileges is distinct from that observed activity; it is not confirmed exploitation by those users. Investigate prior access and managed hosts as well as installing fixes. The vendor’s indicators cover the observed campaign, not every possible attacker. For confirmed compromise, Vates recommends full reinstallation and rotation of passwords and secrets; patching does not establish that persistence has been removed. ## Recommended response Update the affected Xen Orchestra branch, isolate management access and restrict imports to administrators. Apply the separate permission restrictions for VSA-2026-063, which remains unpatched. Relevant to: Teams administering Xen Orchestra or Xen Orchestra Appliance and the XCP-ng pools they manage. ## Affected systems and fixes ### VSA-2026-062: Xen Orchestra stable Affected: Versions before 6.9.2; Xen Orchestra Appliance is affected. Fixed release / action: 6.9.2 stable; xo-server 5.211.2. This correction addresses VSA-2026-062 only. ### VSA-2026-062: Xen Orchestra latest Affected: Versions before 6.10.1; Xen Orchestra Appliance is affected. Fixed release / action: 6.10.1 latest; xo-server 5.213.1. Vates advises installations built from source to update to current master. ### VSA-2026-063: Xen Orchestra and Appliance Affected: 6.10.1 and earlier, including the releases correcting VSA-2026-062. Fixed release / action: No fix is listed in stable or latest in the reviewed advisory. Allow VM import only to administrators and disable users with the permissions identified by Vates. Confirm the running version against the vendor advisory, including any distribution backports. ## Response checklist 1. **Update the matching branch** — Install 6.9.2 stable or 6.10.1 latest, with the corresponding xo-server correction. Verify the running version. These fixes do not resolve the separate import vulnerability. 2. **Restrict import and network privileges** — For VSA-2026-063, Vates says to allow imports only to Admin users and disable users configured with vm.import, sr/import:vm, network/action:create or network/action:update. Review human and service accounts. 3. **Isolate management access** — Remove public Internet exposure and place Xen Orchestra on a dedicated management network. Follow the vendor’s current containment guidance; blocking the listed indicators alone is not proof of safety. 4. **Investigate prior access and managed hosts** — Review the vendor’s campaign indicators on Xen Orchestra and XCP-ng hosts. Successful unauthenticated access may leave no application login record. Absence of the published indicators does not establish absence of compromise. 5. **Recover after confirmed compromise** — Vates recommends full reinstallation after confirmed compromise and rotation of VMS passwords and secrets, including pool, root, backup, user and OTP credentials. A version update alone does not remove persistence. ## Relevance to AI environments Review service accounts and automation with import or network privileges alongside human administrators. ## Sources - [VSA-2026-062: authentication bypass, active exploitation and corrections](https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/) — Vates; Vendor notice; checked 2026-11-12T12:27:20Z - [VSA-2026-063: import permissions, observed administrator abuse and mitigation](https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-063/) — Vates; Vendor notice; checked 2026-11-12T12:27:20Z ## Editorial record - 2026-11-12T12:27:20Z: Added verified vendor scope, response actions and the limits of the available evidence. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/xen-orchestra-vsa-2026-062-063) · [Build a response plan](https://www.oktsec.com/radar/xen-orchestra-vsa-2026-062-063#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=xen-orchestra-vsa-2026-062-063&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=xen-orchestra-vsa-2026-062-063&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.