A Critical Vulnerability in Xen Orchestra Exposes Virtualization Environments to Attackers
Cybersecurity firm Vates has warned of a critical vulnerability in Xen Orchestra, a popular web-based backup and management solution for virtualization environments. The flaw, which affects releases before 6.9.2 (stable) and 6.10.1 (latest), allows attackers to bypass authentication and gain administrator privileges, potentially leading to arbitrary code execution on managed pools and even a full takeover of an XCP-ng node as root.
Xen Orchestra is used by administrators to manage virtual machines, storage, and hosts across multiple environments. Its agentless design makes it easy to deploy and use, but also creates vulnerabilities that can be exploited by attackers. The exploited flaw exists in the REST authentication mechanism, where an authentication token is mishandled, allowing unauthenticated attackers to gain access to sensitive areas of the system.
The vulnerability was detected after a threat actor operating from IP address 91.211.251.112:8001 and using the Tor network began exploiting it. Vates has shared indicators of compromise (IoCs) associated with this specific campaign, but warns that these are limited to this attack alone and may not indicate other potential compromises.
The exploitation of this vulnerability is particularly concerning because it does not log unauthorized access attempts, making it difficult for administrators to detect if their systems have been compromised. However, Vates has provided recommendations for mitigating the risk, including placing Xen Orchestra instances behind a dedicated network, blocking IP addresses and domain names associated with known malicious activity, and rotating all potentially compromised credentials.
In addition to this critical vulnerability, Vates also disclosed a second flaw that was exploited using administrator privileges. This vulnerability allows malicious VM imports that could compromise XCP-ng hosts, and a fix is still being developed.
The Xen Orchestra vulnerability highlights the importance of staying up-to-date with security patches and following best practices for securing virtualization environments. Administrators are advised to review their system configurations and take steps to prevent unauthorized access. In case of a confirmed compromise, a full reinstallation may be necessary to ensure the removal of all backdoors left by the attacker.
As always, it’s essential to remain vigilant and proactive in addressing potential security threats. This incident serves as a reminder that cybersecurity is an ongoing process that requires constant monitoring and maintenance.
Source: SecurityWeek — 2026-11-11