{"slug":"xen-orchestra-auth-bypass-vsa-2026-062","title":"Xen Orchestra auth bypass (VSA-2026-062)","shortName":"Xen Orchestra","seoTitle":"Xen Orchestra (VSA-2026-062): versions, exploitation & detection","summary":"Unauthenticated authentication bypass in Xen Orchestra (VSA-2026-062) lets a crafted empty-object cookie authenticate as the owner of the first unexpired token. Vendor impact: an unauthenticated attacker gets Admin in XO, and Xen Orchestra compromise can lead to arbitrary code execution on managed pools and a full XCP-ng node takeover as root. Confirmed exploited (vendor). CVE: not assigned yet (checked 11 Nov 2026). Not in CISA KEV (catalog 2026.11.10, checked 11 Nov 2026). No public PoC indexed. Live advisory (fetched 11 Nov 2026 UTC; vendor Updated field still 2026-11-10) names Xen Orchestra 6.9.2 (stable, xo-server 5.211.2) and 6.10.1 (latest, xo-server 5.213.1) as the fix. Xen Orchestra Appliance (XOA) is affected.","isExample":false,"draft":false,"family":"xen-orchestra-auth-bypass-vsa-2026-062","kind":"single-product","aliases":["VSA-2026-062","Xen Orchestra auth bypass","XO empty-object login token","XOA","Xen Orchestra Appliance"],"publishedAt":"2026-11-10","updatedAt":"2026-11-11","patchStatus":"patched","exploited":true,"scores":{"cvss":null,"epss":{"score":null,"percentile":null,"date":null,"sourceUrl":"https://api.first.org/data/v1/epss","checkedDate":"2026-11-11"},"kev":{"listed":false,"dateAdded":null,"dueDate":null,"catalogVersion":"2026.11.10","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-11-11"},"addedDate":"2026-11-10"},"priority":{"label":"act-now"},"managementSummary":{"what":"Unauthenticated authentication bypass in Xen Orchestra (VSA-2026-062). CVE: not assigned yet (checked 11 Nov 2026). REST cookie parsing turns an empty-object token into an object, and token lookup then matches the first unexpired token, authenticating as that token's owner. An unauthenticated attacker gets Admin in XO. Vendor: Xen Orchestra compromise can lead to arbitrary code execution on managed pools and a full XCP-ng node takeover as root. Confirmed exploited (vendor). Not in CISA KEV (catalog 2026.11.10, checked 11 Nov 2026). No public PoC indexed. Live advisory (fetched 11 Nov 2026) names 6.9.2 (stable) and 6.10.1 (latest) as the fix.","action":"Install Xen Orchestra 6.9.2 (stable) or 6.10.1 (latest), which include xo-server 5.211.2 and 5.213.1. Source installs: latest master. Keep XO off the internet and on a management network. Block 91.211.251[.]112, the seven additional vendor C2 IPs, and Tor egress. Treat a WAF rule as a stopgap only. If compromise is suspected, rotate proxy, backup remotes (NFS, S3, Azure, SMB), root, pool secret, user-account, OTP, and mail-server secrets. Confirmed compromise: vendor recommends a full reinstallation."},"seenInTheWild":[{"metric":"vendor-stated","value":"This vulnerability is actively exploited by a threat actor","observer":"Vates","date":"2026-11-10","method":"Vates VSA-2026-062, published 2026-11-10. Vendor Updated field still 2026-11-10 as of the 11 Nov 2026 UTC fetch. That is the advisory date, not a first calendar day of exploitation. Vates names campaign infrastructure and host artefacts for this actor. No public first-seen date.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/"}],"seenInTheWildLinks":[{"title":"VSA-2026-062: Empty-object login token","url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","observer":"Vates","metric":"vendor-stated"},{"title":"Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers","url":"https://www.bleepingcomputer.com/news/security/critical-xen-orchestra-auth-bypass-flaw-exploited-to-hijack-vm-servers/","observer":"BleepingComputer","metric":"third-party-stated"}],"whatChanged":{"date":"2026-11-11","items":[{"text":"Rechecked VSA-2026-062 on 11 Nov 2026 UTC. Vendor Published and Updated columns still read 2026-11-10. Live Affected line: Xen Orchestra before 6.9.2 (stable) and 6.10.1 (latest). Resolution: 6.9.2 and 6.10.1 include the fix. xo-server packages are still 5.211.2 (stable) and 5.213.1 (latest). The 10 Nov fetch of the same URL listed 6.9.1 / 6.10.0 and an Affected line naming xo-server before 5.213.1 and 5.213.2; that 5.213.2 wording is gone from the live page. SXZ.io (10 Nov 2026, 19:19 UTC snapshot) recorded the same product-number change.","headline":"Vendor now lists Xen Orchestra 6.9.2 and 6.10.1 as the fixed builds","section":"impact","date":"2026-11-11","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","alsoSourceUrl":"https://sxz.io/xen-orchestra-login-bypass-exploited-vates-advisory-fixed-versions-changed/"},{"text":"Same advisory, fetched 11 Nov 2026: the block list now names 193.148.56[.]72, 37.221.208[.]216, 45.66.35[.]11, 64.65.0[.]120, 64.65.62[.]160, 89.47.51[.]90, and 92.60.37[.]247, plus the original 91.211.251[.]112 and the Tor .onion on port 3333. Rotate also names NFS, Azure, SMB, pool secret, OTP, and mail-server passwords. Vendor: in case of a confirmed compromise, a full reinstallation is recommended. Source installs: update to the latest master.","headline":"Vendor added seven more campaign C2 IPs plus a reinstall note","section":"exploitation","date":"2026-11-11","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/"},{"text":"Rechecked 11 Nov 2026: no CVE is assigned. VSA-2026-062 is not in CISA KEV (catalog 2026.11.10, released 2026-11-10T19:03:29.8375Z, 1,779 entries). GitHub code search on 11 Nov 2026 found news aggregators, not an exploit repository. PoC badge stays No public PoC indexed.","headline":"Still no CVE; not in CISA KEV (catalog 2026.11.10)","section":"exploitation","date":"2026-11-11","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"},{"text":"New catalog page for Xen Orchestra auth bypass (VSA-2026-062). No CVE assigned.","headline":"New catalog page for Xen Orchestra auth bypass VSA-2026-062","section":"overview","date":"2026-11-10","kind":"page"},{"text":"Vates published VSA-2026-062 on 10 Nov 2026 (Critical; CVSS 4.0 not available yet). Quote: \"This vulnerability is actively exploited by a threat actor.\" An unauthenticated attacker gets Admin in XO. Vendor: \"Xen Orchestra compromise can lead to arbitrary code execution on managed pools and a full XCP-ng node takeover as root.\" Fixed packages: xo-server 5.211.2 (stable) and 5.213.1 (latest), in Xen Orchestra 6.9.1 and 6.10.0. Upstream PR 10748. No public PoC indexed (GitHub search 10 Nov 2026).","headline":"Vendor confirms active exploitation; no CVE; patch 6.9.1 and 6.10.0","section":"exploitation","date":"2026-11-10","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","alsoSourceUrl":"https://github.com/vatesfr/xen-orchestra/pull/10748"},{"text":"Rechecked 10 Nov 2026: VSA-2026-062 is not in CISA KEV (catalog 2026.11.09, released 2026-11-09T19:54:37.4945Z, 1,773 entries). No CVE is assigned, so there is no CVE row to list.","headline":"Not in CISA KEV (catalog 2026.11.09, checked 10 Nov 2026)","section":"exploitation","date":"2026-11-10","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},"whatTheBugIs":"VSA-2026-062 is an unauthenticated authentication bypass in Xen Orchestra and the Xen Orchestra Appliance (XOA). Vates published the advisory on 10 Nov 2026. The Published and Updated columns still read 2026-11-10 as of a fetch on 11 Nov 2026 UTC; the live text is not the same as the 10 Nov fetch. Severity: Critical. CVSS 4.0: Not available yet. CVE: not assigned yet (checked 11 Nov 2026). Do not invent a CVE. The identifier on this page is VSA-2026-062.\n\nPreconditions, from the vendor: network reach to the Xen Orchestra web or REST interface, and at least one unexpired authentication token on the server.\n\nRoot cause, high level only. REST cookie parsing turns an empty-object token into an object. Token lookup then matches the first token and authenticates as that token's owner if it is unexpired. This page does not describe how to reuse a token.\n\nImpact, quoted from Vates: an unauthenticated attacker can bypass authentication and perform actions with Admin privilege. \"Xen Orchestra compromise can lead to arbitrary code execution on managed pools and a full XCP-ng node takeover as root.\" That is the shell path.\n\nAffected, from the live advisory (fetched 11 Nov 2026 UTC): Xen Orchestra before 6.9.2 (stable) and 6.10.1 (latest), and Xen Orchestra Appliance. Resolution on that same page: as of 2026-11-10, Xen Orchestra 6.10.1 and 6.9.2 include the fix. Fixed packages: xo-server 5.211.2 (stable) and 5.213.1 (latest). Source installs: update to the latest master. Upstream fix: vatesfr/xen-orchestra pull request 10748 (\"fix(xo-server): validate authentication token IDs\", merged 10 Nov 2026). The 10 Nov fetch of the same URL listed 6.9.1 / 6.10.0 and an Affected line naming \"xo-server before 5.213.1 and 5.213.2\". That 5.213.2 wording is gone from the live page. This catalog records both snapshots and does not guess why the product numbers changed.\n\nExploitation: Confirmed exploited (vendor). Live quote: \"This vulnerability is actively exploited by a threat actor.\" First-seen date is not public; 10 Nov 2026 is the advisory date. Not in CISA KEV (catalog 2026.11.10, released 2026-11-10T19:03:29.8375Z, 1,779 entries, checked 11 Nov 2026). No public PoC indexed (GitHub code search for VSA-2026-062, 11 Nov 2026). PoC badge: No public PoC indexed.\n\nCredit, as the vendor credits them: Filip Magic (@mad31k) and Christoffer Olsen, TDC NET Security.","attackPath":{"caption":"High-level only. Not a reproduction guide. No cookie construction, token-reuse steps, or payloads.","steps":[{"id":"reach","label":"Unauthenticated REST request","detail":"Network reach to the Xen Orchestra web or REST interface. Vendor precondition: at least one unexpired authentication token on the server."},{"id":"app","label":"XO Admin","detail":"Empty-object token parsing plus first-token lookup authenticates as that token's owner. Vendor: Admin privilege. Conceptual impact class only."},{"id":"exec","label":"Code execution on managed pools","detail":"Vendor: Xen Orchestra compromise can lead to arbitrary code execution on managed pools."},{"id":"shell","label":"Root on XCP-ng hosts","detail":"Vendor: a full XCP-ng node takeover as root."}]},"exploitation":{"kev":{"listed":false,"date":"2026-11-10","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"Not in CISA KEV (checked 11 Nov 2026) against catalog 2026.11.10 (released 2026-11-10T19:03:29.8375Z, 1,779 entries). No CVE is assigned, so there is no CVE row to list."},"firstSeen":{"date":"2026-11-10","source":"Vates VSA-2026-062, published 2026-11-10","note":"Vates: \"This vulnerability is actively exploited by a threat actor.\" That is the 10 Nov 2026 advisory date, not a first calendar day of exploitation. No public first-seen date.","dateLabel":"Vendor advisory"},"vendorStatements":[{"vendor":"Vates","date":"2026-11-10","statement":"This vulnerability is actively exploited by a threat actor operating intially from 91.211.251.112:8001 and ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid.onion:3333 (via Tor)","url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","retracted":false},{"vendor":"Vates","date":"2026-11-10","statement":"An adversary can bypass authentication and perform actions with 'Admin' privilege. Xen Orchestra compromise can lead to arbitrary code execution on managed pools and a full XCP-ng node takeover as root.","url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","retracted":false}]},"timeline":[{"date":"2026-11-10","event":"vatesfr/xen-orchestra pull request 10748 merged: fix(xo-server): validate authentication token IDs. Advisory later names this as the upstream fix.","source":{"title":"fix(xo-server): validate authentication token IDs","url":"https://github.com/vatesfr/xen-orchestra/pull/10748","publisher":"Vates"},"kind":"patch","key":true},{"date":"2026-11-10","event":"Vates published VSA-2026-062 (Empty-object login token). Critical. CVSS 4.0 not available yet. Xen Orchestra 6.9.1 (stable, xo-server 5.211.2) and 6.10.0 (latest, xo-server 5.213.1) include the fix. XOA affected. Credit: Filip Magic (@mad31k) and Christoffer Olsen, TDC NET Security. No CVE assigned.","source":{"title":"VSA-2026-062: Empty-object login token","url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","publisher":"Vates"},"kind":"advisory","key":true},{"date":"2026-11-10","event":"Vates: this vulnerability is actively exploited by a threat actor. Badge: Exploited in the wild (vendor). 10 Nov is the advisory date, not a first-seen exploitation day.","source":{"title":"VSA-2026-062: Empty-object login token","url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","publisher":"Vates"},"kind":"exploited","key":true},{"date":"2026-11-10","event":"BleepingComputer coverage: Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers. Direct HTTP fetch returned Cloudflare 403; title confirmed via search index on 10 Nov 2026.","source":{"title":"Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers","url":"https://www.bleepingcomputer.com/news/security/critical-xen-orchestra-auth-bypass-flaw-exploited-to-hijack-vm-servers/","publisher":"BleepingComputer"},"kind":"other"},{"date":"2026-11-10","event":"Not in CISA KEV. Catalog 2026.11.09 (released 2026-11-09T19:54:37.4945Z, 1,773 entries). Rechecked 10 Nov 2026. No CVE is assigned, so there is no CVE row to list.","source":{"title":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"other"},{"date":"2026-11-10","event":"The Hacker News (Ravie Lakshmanan, 10 Nov 2026): Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access. No CVE. Article still names 6.9.1 and 6.10.0, matching the earlier advisory text.","source":{"title":"Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access","url":"https://thehackernews.com/2026/11/hackers-exploit-critical-xen-orchestra.html","publisher":"The Hacker News"},"kind":"other"},{"date":"2026-11-10","event":"SXZ.io (10 Nov 2026, snapshot about 19:00 to 20:00 UTC): the advisory's fixed versions changed during the day from 6.10.0 / 6.9.1 (Internet Archive 11:31 UTC) to 6.10.1 / 6.9.2 (live at 19:19 UTC). Block list grew from one address to eight. xo-server packages stayed 5.213.1 and 5.211.2. Vendor Updated column still 2026-11-10.","source":{"title":"Vates Says Attackers Are Exploiting a Xen Orchestra Login Bypass Triggered by an Empty Cookie Object, and Its Advisory Changed the Fixed Versions From 6.10.0 and 6.9.1 to 6.10.1 and 6.9.2 Within the Day","url":"https://sxz.io/xen-orchestra-login-bypass-exploited-vates-advisory-fixed-versions-changed/","publisher":"SXZ.io"},"kind":"other"},{"date":"2026-11-11","event":"Rechecked the live Vates advisory. Published and Updated still 2026-11-10. Affected: Xen Orchestra before 6.9.2 (stable) and 6.10.1 (latest). Resolution: 6.9.2 and 6.10.1. xo-server packages still 5.211.2 / 5.213.1. No CVE. CVSS 4.0 still Not available yet.","source":{"title":"VSA-2026-062: Empty-object login token","url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","publisher":"Vates"},"kind":"advisory","key":true},{"date":"2026-11-11","event":"Not in CISA KEV. Catalog 2026.11.10 (released 2026-11-10T19:03:29.8375Z, 1,779 entries). Rechecked 11 Nov 2026. No CVE is assigned, so there is no CVE row to list.","source":{"title":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"other"}],"openNotes":[{"title":"CVE: not assigned yet (checked 11 Nov 2026)","detail":"VSA-2026-062 does not name a CVE. CVSS 4.0 is listed as Not available yet. There is no official CVSS record to store against a CVE, and FIRST EPSS has no row to query. Identifiers on this page are VSA-2026-062 and the xo-server / Xen Orchestra version numbers.","sources":[{"url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","date":"2026-11-11","publisher":"Vates"}]},{"title":"Advisory product numbers changed on 10 Nov without a new Updated date","detail":"A 10 Nov fetch of the advisory listed Xen Orchestra 6.9.1 / 6.10.0 as the fix and an Affected line saying \"xo-server before 5.213.1 and 5.213.2 in Xen Orchestra before 6.9.1 (stable) and 6.10.0 (latest): Affected.\" The live page fetched 11 Nov 2026 UTC names 6.9.2 / 6.10.1 and no longer has that 5.213.2 wording. Published and Updated still read 2026-11-10. xo-server packages are 5.211.2 (stable) and 5.213.1 (latest) on both snapshots. SXZ.io (10 Nov 2026) recorded the same change and could not find 6.9.2 / 6.10.1 headings on the public changelog. This page shows the live vendor wording and the earlier snapshot, and does not guess which product number is the install target beyond what Vates currently prints.","sources":[{"url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","date":"2026-11-11","publisher":"Vates"},{"url":"https://sxz.io/xen-orchestra-login-bypass-exploited-vates-advisory-fixed-versions-changed/","date":"2026-11-10","publisher":"SXZ.io"}]}],"defenderActions":[{"title":"Install Xen Orchestra 6.9.2 or 6.10.1","detail":"Live advisory (fetched 11 Nov 2026): as of 2026-11-10, 6.9.2 (stable, xo-server 5.211.2) and 6.10.1 (latest, xo-server 5.213.1) include the fix. XOA updates through those channels. Source installs: latest master.","priority":"now","links":[{"label":"VSA-2026-062","href":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/"},{"label":"Upstream PR 10748","href":"https://github.com/vatesfr/xen-orchestra/pull/10748"}]},{"title":"Keep Xen Orchestra off the internet","detail":"Vates: do not expose Xen Orchestra to the Internet. Put the instance on a dedicated management network.","priority":"now","links":[{"label":"VSA-2026-062","href":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/"}]},{"title":"Block the campaign C2 IPs and Tor egress","detail":"Vates: block 91.211.251[.]112, 193.148.56[.]72, 37.221.208[.]216, 45.66.35[.]11, 64.65.0[.]120, 64.65.62[.]160, 89.47.51[.]90, 92.60.37[.]247, and Tor traffic used to reach the published .onion on port 3333. These IOCs cover this campaign only.","priority":"now","links":[{"label":"VSA-2026-062","href":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/"}]},{"title":"Treat a WAF empty-token rule as a stopgap only","detail":"Vates: you can block the empty token in a WAF or reverse proxy, but be cautious with regex; the rule can be bypassed using other formats.","priority":"soon","links":[{"label":"VSA-2026-062","href":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/"}]},{"title":"If compromise is suspected, rotate every secret XO holds","detail":"Rotate proxy, backup remotes (NFS, S3, Azure, SMB), root account and pool secret, user accounts, OTP secrets, and mail-server passwords. If compromise is confirmed, vendor recommends a full reinstallation. Hunt the vendor-published host artefacts on managed XCP-ng nodes.","priority":"now","links":[{"label":"VSA-2026-062","href":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/"}]}],"detection":[{"title":"XO itself leaves no log of the unauthenticated access","detail":"Vates: in the case of a successful exploitation, there is no log to detect unauthenticated access. Use HTTP capture or reverse-proxy / WAF logs in front of XO.","logSource":"HTTP capture (tcpdump or Wireshark) or reverse-proxy / WAF logs in front of Xen Orchestra","kind":"generic","group":"web-proxy","url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","date":"2026-11-10","described":true},{"title":"Vendor-published Cookie patterns","detail":"Vates publishes these HTTP patterns as detection strings: authenticationToken=j:%7B%7D and authenticationToken=j:{}. Match them in capture or proxy logs. Vendor warns other encodings exist.","logSource":"HTTP capture or reverse-proxy / WAF logs in front of Xen Orchestra","kind":"generic","group":"web-proxy","url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","date":"2026-11-10","described":true},{"title":"VM named pivot2","detail":"Vates: search for a pivot2 VM in running VMs. This artefact is for the published campaign only.","logSource":"Xen Orchestra VM inventory or XCP-ng xe vm-list","kind":"generic","url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","date":"2026-11-10","described":true},{"title":"VMs with hvm_serial: file","detail":"Vates XCP-ng check: xe vm-list params=name-label,platform | grep -B1 'hvm_serial: file'. A match is a lead for this campaign, not proof of this bug on every host.","logSource":"XCP-ng host (xe vm-list)","kind":"generic","url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","date":"2026-11-10","described":true},{"title":"xensource.log serial-file events","detail":"Vates: zgrep -- '-serial file:' /var/log/xensource.log*. Hunt for serial-file configuration events on XCP-ng hosts.","logSource":"XCP-ng /var/log/xensource.log*","kind":"generic","url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","date":"2026-11-10","described":true},{"title":"Campaign files and ld.so.preload","detail":"Vates: look for /etc/cron.d/zz-ustar, /etc/cron.d/zz-ustar2, /.ustar5, /.ustar6, and also check /etc/ld.so.preload. Suggested listing: ls -la /etc/ld.so.preload /.ustar* /etc/cron.d/zz-ustar*. Absence of these files does not prove the host is clean.","logSource":"XCP-ng host filesystem","kind":"generic","group":"edr","url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","date":"2026-11-10","described":true}],"detectionRules":[{"id":"v2s-sigma-xen-orchestra-empty-object-cookie","title":"Xen Orchestra empty-object login token cookie","language":"sigma","query":"title: Xen Orchestra empty-object login token cookie\nid: 9e4a1c7b-2d83-4f6e-a1b5-0c8d7e3f2a91\nstatus: experimental\ndescription: Detects vendor-published Cookie values for VSA-2026-062 empty-object login token. Patterns published by Vates. Not a reproduction guide.\nreferences:\n    - https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/\nauthor: vuln2shell\ndate: 2026/11/10\nlogsource:\n    category: webserver\ndetection:\n    selection:\n        cs-cookie|contains:\n            - 'authenticationToken=j:%7B%7D'\n            - 'authenticationToken=j:{}'\n    condition: selection\nfalsepositives:\n    - Unlikely on Xen Orchestra frontends\nlevel: high","logSource":"HTTP capture or reverse-proxy / WAF logs in front of Xen Orchestra","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10","license":"CC0 1.0","origin":"vuln2shell","notes":"Cookie patterns published by Vates. This query wraps them for web logs. Untested. Vendor warns other encodings exist.","tested":"untested"},{"id":"v2s-spl-xen-orchestra-empty-object-cookie","title":"Xen Orchestra empty-object login token cookie","language":"spl","query":"index=* (Cookie=\"*authenticationToken=j:%7B%7D*\" OR Cookie=\"*authenticationToken=j:{}*\" OR cs_cookie=\"*authenticationToken=j:%7B%7D*\" OR cs_cookie=\"*authenticationToken=j:{}*\")\n| stats count min(_time) as firstTime max(_time) as lastTime by src, dest, Cookie, cs_cookie","logSource":"HTTP capture or reverse-proxy / WAF logs in front of Xen Orchestra","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10","license":"CC0 1.0","origin":"vuln2shell","notes":"Cookie patterns published by Vates. Field names vary by sourcetype. Untested. Vendor warns other encodings exist.","tested":"untested"},{"id":"v2s-kql-xen-orchestra-empty-object-cookie","title":"Xen Orchestra empty-object login token cookie","language":"kql","query":"union isfuzzy=true CommonSecurityLog, W3CIISLog, AppProxyLog\n| where * has \"authenticationToken=j:%7B%7D\" or * has \"authenticationToken=j:{}\"\n| project TimeGenerated, Computer, SourceIP, DestinationHostName, RequestCookie, Cookie","logSource":"HTTP capture or reverse-proxy / WAF logs in front of Xen Orchestra","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10","license":"CC0 1.0","origin":"vuln2shell","notes":"Cookie patterns published by Vates. Broad * has hunt; tune to the proxy table you actually collect. Untested. Vendor warns other encodings exist.","tested":"untested"}],"detectionLinks":[],"retrohunt":{"summary":"XO leaves no application log of the unauthenticated access, so lookback is HTTP capture or reverse-proxy logs plus XCP-ng host artefacts. Vendor IOCs cover this campaign only. Absence of a hit does not prove you are clean.","lookback":{"from":"2026-11-10","basis":"public-disclosure","rationale":"Vates published VSA-2026-062 on 10 Nov 2026 and stated active exploitation. No public first-seen date, so lookback starts at the advisory day. Extend earlier if your own capture exists.","sources":[{"url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","date":"2026-11-10","publisher":"Vates"}],"searchLine":"authenticationToken=j:%7B%7D OR authenticationToken=j:{}"},"logSources":[{"name":"HTTP capture or reverse-proxy / WAF logs in front of XO","why":"Vates: there is no XO log of unauthenticated access. The exploit is detected by monitoring HTTP requests.","required":true},{"name":"XCP-ng xe vm-list and /var/log/xensource.log*","why":"Vendor host checks for pivot2, hvm_serial: file, and serial-file events.","required":true},{"name":"XCP-ng host filesystem","why":"Vendor listing of zz-ustar cron files, /.ustar5, /.ustar6, and /etc/ld.so.preload.","required":true}],"steps":[{"title":"Search HTTP logs for the vendor cookie patterns","detail":"Match authenticationToken=j:%7B%7D and authenticationToken=j:{}. Vendor warns other encodings exist.","sources":[{"url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","date":"2026-11-10","publisher":"Vates"}]},{"title":"Run the vendor xe and xensource.log checks on XCP-ng hosts","detail":"xe vm-list params=name-label,platform | grep -B1 'hvm_serial: file'. Search for pivot2. zgrep -- '-serial file:' /var/log/xensource.log*.","sources":[{"url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","date":"2026-11-10","publisher":"Vates"}]},{"title":"List the vendor files and ld.so.preload","detail":"ls -la /etc/ld.so.preload /.ustar* /etc/cron.d/zz-ustar*. A miss is not a clean bill of health.","sources":[{"url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","date":"2026-11-10","publisher":"Vates"}]}],"queries":[{"id":"v2s-rh-xen-orchestra-empty-object-cookie","title":"Xen Orchestra empty-object login token cookie (lookback)","language":"sigma","query":"title: Xen Orchestra empty-object login token cookie lookback\nid: 2b7c9e14-5a60-4d2f-9c81-6e4f0d8a3b17\nstatus: experimental\ndescription: Lookback wrapper for vendor-published VSA-2026-062 Cookie values.\nreferences:\n    - https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/\nauthor: vuln2shell\ndate: 2026/11/10\nlogsource:\n    category: webserver\ndetection:\n    selection:\n        cs-cookie|contains:\n            - 'authenticationToken=j:%7B%7D'\n            - 'authenticationToken=j:{}'\n    condition: selection\nfalsepositives:\n    - Unlikely on Xen Orchestra frontends\nlevel: high","logSource":"HTTP capture or reverse-proxy / WAF logs in front of Xen Orchestra","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10","license":"CC0 1.0","origin":"vuln2shell","notes":"Same vendor cookie patterns as Detection. Lookback from the 10 Nov 2026 advisory day. Untested.","tested":"untested","timeRange":"From 10 Nov 2026 (public disclosure) through now. Vendor first-seen date is not public; extend earlier if you have capture."}],"artefacts":[{"kind":"web-log","value":"authenticationToken=j:%7B%7D","detail":"Vendor-published HTTP detection string.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"},{"kind":"web-log","value":"authenticationToken=j:{}","detail":"Vendor-published HTTP detection string.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"},{"kind":"report","value":"pivot2","detail":"Vendor: search for this VM name in running VMs.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"},{"kind":"device-log","value":"hvm_serial: file","detail":"Vendor xe vm-list check on XCP-ng hosts.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"},{"kind":"file","value":"/etc/cron.d/zz-ustar","detail":"Vendor-published campaign file.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"},{"kind":"file","value":"/etc/cron.d/zz-ustar2","detail":"Vendor-published campaign file.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"},{"kind":"file","value":"/.ustar5","detail":"Vendor-published campaign file.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"},{"kind":"file","value":"/.ustar6","detail":"Vendor-published campaign file.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"}],"iocs":[{"type":"ip","value":"91.211.251[.]112","context":"Vendor C2 on TCP 8001. Campaign-only. Defanged.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"},{"type":"ip","value":"193.148.56[.]72","context":"Vendor C2 added on the live advisory (fetched 11 Nov 2026; vendor Updated still 2026-11-10). Campaign-only. Defanged.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"},{"type":"ip","value":"37.221.208[.]216","context":"Vendor C2 added on the live advisory (fetched 11 Nov 2026; vendor Updated still 2026-11-10). Campaign-only. Defanged.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"},{"type":"ip","value":"45.66.35[.]11","context":"Vendor C2 added on the live advisory (fetched 11 Nov 2026; vendor Updated still 2026-11-10). Campaign-only. Defanged.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"},{"type":"ip","value":"64.65.0[.]120","context":"Vendor C2 added on the live advisory (fetched 11 Nov 2026; vendor Updated still 2026-11-10). Campaign-only. Defanged.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"},{"type":"ip","value":"64.65.62[.]160","context":"Vendor C2 added on the live advisory (fetched 11 Nov 2026; vendor Updated still 2026-11-10). Campaign-only. Defanged.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"},{"type":"ip","value":"89.47.51[.]90","context":"Vendor C2 added on the live advisory (fetched 11 Nov 2026; vendor Updated still 2026-11-10). Campaign-only. Defanged.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"},{"type":"ip","value":"92.60.37[.]247","context":"Vendor C2 added on the live advisory (fetched 11 Nov 2026; vendor Updated still 2026-11-10). Campaign-only. Defanged.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"},{"type":"domain","value":"ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid[.]onion","context":"Vendor Tor C2 on port 3333. Campaign-only. Defanged.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"},{"type":"filename","value":"pivot2","context":"Vendor: VM named pivot2. Campaign-only.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"},{"type":"path","value":"/etc/cron.d/zz-ustar","context":"Vendor-published campaign file on XCP-ng hosts.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"},{"type":"path","value":"/etc/cron.d/zz-ustar2","context":"Vendor-published campaign file on XCP-ng hosts.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"},{"type":"path","value":"/.ustar5","context":"Vendor-published campaign file on XCP-ng hosts.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"},{"type":"path","value":"/.ustar6","context":"Vendor-published campaign file on XCP-ng hosts.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"}],"iocNote":"Vendor-published and only for this campaign. Vates: the absence of these IoCs alone is not sufficient to conclude that no compromise has occurred. Other threat actors using different TTPs and infrastructure cannot be ruled out.","hitMeaning":[{"level":"attempt","detail":"A vendor cookie pattern in HTTP capture or proxy logs, with no host artefacts and no C2 traffic."},{"level":"likely-compromise","detail":"Cookie pattern plus a pivot2 VM, hvm_serial: file, or egress to 91.211.251[.]112, any of the seven additional vendor C2 IPs, or the published .onion."},{"level":"compromise","detail":"Campaign files (/etc/cron.d/zz-ustar, /etc/cron.d/zz-ustar2, /.ustar5, /.ustar6) or confirmed C2 plus unexpected Admin use of XO on an unpatched instance. Independent validation on your estate: your evidence, not this page.","label":"Compromise (your evidence)"}],"nextSteps":[{"title":"Patch XO, then hunt hosts","detail":"Install 6.9.2 or 6.10.1, isolate XO, then run the vendor xe / xensource.log / filesystem checks on managed XCP-ng nodes.","links":[{"label":"VSA-2026-062","href":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/"}]},{"title":"Rotate secrets XO holds if a host artefact or C2 hit exists","detail":"Proxy, backup, S3, root, and user-account secrets. Preserve HTTP capture and xe output from before restore.","links":[{"label":"VSA-2026-062","href":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/"}]}],"limits":["Vates: these IoCs cover this specific campaign only.","Vates: the absence of these IoCs alone is not sufficient to conclude that no compromise has occurred.","XO itself leaves no log of the unauthenticated access.","Do not send a crafted cookie as a test."],"sources":[{"url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","date":"2026-11-10","publisher":"Vates"}],"updatedAt":"2026-11-11"},"amIAffected":{"summary":"Xen Orchestra before 6.9.2 (stable) or 6.10.1 (latest), including XOA, is in scope when the web or REST interface is reachable and the server holds at least one unexpired authentication token. Source installs are in scope until they are on latest master. CVE-keyed scanners will not flag this bug. Do not send a test cookie.","checks":[{"id":"v2s-aia-xen-orchestra-auth-bypass-vsa-2026-062-version-1","kind":"version","title":"Record the installed Xen Orchestra version","detail":"Compare the product version from the XO UI or appliance about page to 6.9.2 (stable) or 6.10.1 (latest). Inventory only. Do not send a test cookie.","command":"Record the Xen Orchestra version shown in the product UI or XOA about page, and compare it to 6.9.2 (stable) or 6.10.1 (latest).","affectedMeans":"Xen Orchestra is below 6.9.2 on stable, or below 6.10.1 on latest, or XOA has not taken that channel update.","fixedMeans":"Xen Orchestra is 6.9.2 or later on stable, or 6.10.1 or later on latest, including an updated XOA.","notes":"Channel (stable vs latest) decides which floor applies. Do not mix them.","sources":[{"url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","date":"2026-11-10","publisher":"Vates"}]},{"id":"v2s-aia-xen-orchestra-auth-bypass-vsa-2026-062-package-2","kind":"package","title":"Record the installed xo-server package version","detail":"Fixed packages: xo-server 5.211.2 (stable) and 5.213.1 (latest). Inventory the package. Do not send application requests.","command":"Record the installed xo-server package version and compare it to 5.211.2 (stable) or 5.213.1 (latest).","affectedMeans":"xo-server is older than 5.211.2 on stable, or older than 5.213.1 on latest.","fixedMeans":"xo-server is 5.211.2 or later on stable, or 5.213.1 or later on latest.","notes":"Live advisory (fetched 11 Nov 2026) no longer prints the 10 Nov Affected line that named xo-server before 5.213.1 and 5.213.2. Packages are still 5.211.2 / 5.213.1. See the open note.","sources":[{"url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","date":"2026-11-10","publisher":"Vates"}]},{"id":"v2s-aia-xen-orchestra-auth-bypass-vsa-2026-062-exposure-3","kind":"exposure","title":"Record whether the XO web or REST interface is reachable","detail":"Vendor precondition: network reach to the web or REST interface. Record internet and untrusted-network reachability. Do not probe with a crafted cookie.","command":"Record whether networks other than the management network can complete a connection to the Xen Orchestra web UI or REST interface.","affectedMeans":"An in-scope XO version is reachable from untrusted networks, including the internet.","fixedMeans":"Only the dedicated management network can reach XO, or XO is patched.","notes":"Keeping XO off the internet is a vendor mitigation, not a software fix.","sources":[{"url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","date":"2026-11-10","publisher":"Vates"}]},{"id":"v2s-aia-xen-orchestra-auth-bypass-vsa-2026-062-config-4","kind":"config","title":"Record whether the server holds an unexpired authentication token","detail":"Vendor precondition: at least one unexpired authentication token on the server. Inventory that fact from your own token-management records. Do not send a test cookie or reuse a token.","command":"From your own XO token-management records, note whether at least one authentication token is still unexpired. Do not query that through a crafted request.","affectedMeans":"An in-scope XO version is reachable and at least one authentication token is still unexpired.","fixedMeans":"XO is patched, or no unexpired token remains and the interface is not reachable from untrusted networks (workaround only).","notes":"Token expiry is a precondition, not a substitute for the patch.","sources":[{"url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","date":"2026-11-10","publisher":"Vates"}]}],"limits":["No sourced Shodan or Censys fingerprint. Do not invent a port or banner.","CVE-keyed scanners will not flag this bug while it has no CVE.","Do not send a crafted cookie as a test.","The 10 Nov advisory text listed 6.9.1 / 6.10.0 and xo-server before 5.213.1 and 5.213.2. The live 11 Nov fetch names 6.9.2 / 6.10.1. See the open note."],"sources":[{"url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","date":"2026-11-10","publisher":"Vates"}],"updatedAt":"2026-11-11","addedDate":"2026-11-10"},"mitigations":{"summary":"Vates documents network isolation, C2 blocking, and a WAF empty-token rule until you can patch. The WAF rule is a stopgap only. None of these replace 6.9.2 or 6.10.1.","items":[{"title":"Keep Xen Orchestra off the internet and on a management network","detail":"Vates: do not expose Xen Orchestra to the Internet. Put the instance on a dedicated management network.","limits":"Not a software fix. Anyone who can already reach the management network still has the REST path. Still patch.","verify":"Untrusted networks, including the internet, can no longer complete a connection to the XO web UI or REST interface. Confirm at the edge, then re-check after the next change window. Do not send a test cookie.","source":{"url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","date":"2026-11-10","publisher":"Vates"}},{"title":"Block the campaign C2 IPs and Tor egress","detail":"Vates: add a filter rule for ingress and egress to block 91.211.251[.]112, 193.148.56[.]72, 37.221.208[.]216, 45.66.35[.]11, 64.65.0[.]120, 64.65.62[.]160, 89.47.51[.]90, and 92.60.37[.]247, and block Tor traffic to prevent communication with the published .onion.","limits":"These IOCs cover this campaign only. Other actors may use different infrastructure. Absence of these IOCs does not prove you are clean.","verify":"Edge logs show denied traffic to the eight vendor C2 IPs (defanged 91.211.251[.]112 and seven more) and Tor egress is blocked from XO and XCP-ng hosts. Re-check after the next firewall change.","source":{"url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","date":"2026-11-10","publisher":"Vates"}},{"title":"Block the empty token in a WAF or reverse proxy (stopgap only)","detail":"Vates: block the empty token in a WAF or a reverse proxy. Be cautious with regex; the rule can be bypassed using other formats.","limits":"Stopgap only. Vendor warns other encodings bypass a regex. Still patch. Still isolate XO.","verify":"The WAF or reverse proxy logs a deny on the vendor-published cookie patterns. Treat misses as expected. Do not send a test cookie from an untrusted network as a proof.","source":{"url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","date":"2026-11-10","publisher":"Vates"}}],"updatedAt":"2026-11-11"},"response":{"summary":"If an in-scope XO was reachable before patching, treat Admin in XO and managed XCP-ng hosts as exposed. Patch, isolate, block the published C2 IPs, hunt the vendor artefacts, and rotate every secret XO holds. Confirmed compromise: vendor recommends a full reinstallation. Vates: absence of these IOCs is not enough to conclude that no compromise has occurred.","containment":[{"title":"Install the channel update","detail":"XO 6.9.2 (stable) or 6.10.1 (latest), including XOA. Source installs: latest master.","sources":[{"url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","date":"2026-11-10","publisher":"Vates"}]},{"title":"Remove internet reach to XO","detail":"Move XO onto a dedicated management network. Do not expose it to the Internet.","sources":[{"url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","date":"2026-11-10","publisher":"Vates"}]},{"title":"Block the eight vendor C2 IPs and Tor egress","detail":"Vendor: immediate blocking of traffic to and from the identified C2 infrastructure is strongly recommended. Live list (fetched 11 Nov 2026): 91.211.251[.]112 plus seven more IPs, and the Tor .onion.","sources":[{"url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","date":"2026-11-10","publisher":"Vates"}]},{"title":"If compromise is confirmed, reinstall","detail":"Vates: in case of a confirmed compromise, a full reinstallation is recommended as cleanup alone cannot guarantee the removal of all backdoors left by the attacker.","sources":[{"url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","date":"2026-11-10","publisher":"Vates"}]}],"rotate":[{"item":"Proxy, backup remotes (NFS, S3, Azure, SMB), root account and pool secret, user accounts, OTP secrets, and mail-server passwords","reason":"Vendor: rotate all passwords and secrets used by Vates VMS if Xen Orchestra has been compromised. Admin in XO can reach managed pools.","sources":[{"url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","date":"2026-11-10","publisher":"Vates"}]}],"persistence":[{"kind":"cron","value":"/etc/cron.d/zz-ustar","detail":"Vendor-published campaign file on XCP-ng hosts.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"},{"kind":"cron","value":"/etc/cron.d/zz-ustar2","detail":"Vendor-published campaign file on XCP-ng hosts.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"},{"kind":"path","value":"/.ustar5","detail":"Vendor-published campaign file on XCP-ng hosts.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"},{"kind":"path","value":"/.ustar6","detail":"Vendor-published campaign file on XCP-ng hosts.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"},{"kind":"path","value":"/etc/ld.so.preload","detail":"Vendor detection listing also checks this path. A hit is a lead; the file is not unique to this campaign.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"},{"kind":"other","value":"pivot2","detail":"Vendor: search for a VM named pivot2.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"}],"observedBehaviour":[{"title":"C2 91.211.251[.]112:8001","detail":"Vendor: threat actor operating from this address and port. Defanged on this page as 91.211.251[.]112.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"},{"title":"Tor .onion on port 3333","detail":"Vendor: ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid[.]onion:3333 via Tor.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"},{"title":"VMs with hvm_serial: file","detail":"Vendor XCP-ng check for serial-port-to-file configuration.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"},{"title":"Seven additional vendor C2 IPs","detail":"Live advisory (fetched 11 Nov 2026) also lists 193.148.56[.]72, 37.221.208[.]216, 45.66.35[.]11, 64.65.0[.]120, 64.65.62[.]160, 89.47.51[.]90, 92.60.37[.]247. Campaign-only. Defanged.","sourceUrl":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","sourceDate":"2026-11-10"}],"evidence":[{"title":"HTTP capture or reverse-proxy logs from before the patch","detail":"XO itself leaves no log of the unauthenticated access. Keep capture or proxy logs covering the vendor cookie patterns."},{"title":"xe vm-list and xensource.log output","detail":"Keep the vendor xe and zgrep output from XCP-ng hosts, plus any pivot2 inventory hit."},{"title":"Filesystem listing of zz-ustar and .ustar paths","detail":"Keep ls output for /etc/ld.so.preload, /.ustar*, and /etc/cron.d/zz-ustar* from before cleanup."}],"limits":["Vates: these detection methods only cover this specific campaign. Other threat actors using different TTPs and infrastructure cannot be ruled out.","Vates: the absence of these IoCs alone is not sufficient to conclude that no compromise has occurred.","Do not send a crafted cookie as a test."],"sources":[{"url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","date":"2026-11-10","publisher":"Vates"}],"updatedAt":"2026-11-11"},"bulletins":[],"coverage":[{"title":"VSA-2026-062: Empty-object login token","publisher":"Vates","url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","date":"2026-11-10","type":"vendor"},{"title":"fix(xo-server): validate authentication token IDs","publisher":"Vates","url":"https://github.com/vatesfr/xen-orchestra/pull/10748","date":"2026-11-10","type":"vendor"},{"title":"Critical Xen Orchestra auth bypass flaw exploited to hijack VM servers","publisher":"BleepingComputer","url":"https://www.bleepingcomputer.com/news/security/critical-xen-orchestra-auth-bypass-flaw-exploited-to-hijack-vm-servers/","date":"2026-11-10","type":"news"},{"title":"CISA KEV catalog JSON (no VSA-2026-062 or Xen Orchestra row; catalog 2026.11.10)","publisher":"CISA","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-11-10","type":"government"},{"title":"Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access","publisher":"The Hacker News","url":"https://thehackernews.com/2026/11/hackers-exploit-critical-xen-orchestra.html","date":"2026-11-10","type":"news"},{"title":"Vates Says Attackers Are Exploiting a Xen Orchestra Login Bypass Triggered by an Empty Cookie Object, and Its Advisory Changed the Fixed Versions From 6.10.0 and 6.9.1 to 6.10.1 and 6.9.2 Within the Day","publisher":"SXZ.io","url":"https://sxz.io/xen-orchestra-login-bypass-exploited-vates-advisory-fixed-versions-changed/","date":"2026-11-10","type":"news"}],"posts":[],"research":[{"title":"VSA-2026-062: Empty-object login token","url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","authors":"Filip Magic (@mad31k) and Christoffer Olsen, TDC NET Security (credited by Vates)","date":"2026-11-10"},{"title":"fix(xo-server): validate authentication token IDs","url":"https://github.com/vatesfr/xen-orchestra/pull/10748","authors":"mpiton (Vates)","date":"2026-11-10"}],"impact":{"kind":"single-product","product":"Xen Orchestra","versions":[{"version":"Xen Orchestra before 6.9.2 (stable channel)","status":"affected","versions":"6.9.2 (xo-server 5.211.2)","vendorStatement":{"date":"2026-11-10","url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","quote":"As of 2026-11-10, Xen Orchestra version 6.10.1 and Xen Orchestra 6.9.2 has been updated and includes the fix for this issue. It is currently available on the latest channel and on stable channel."}},{"version":"Xen Orchestra before 6.10.1 (latest channel)","status":"affected","versions":"6.10.1 (xo-server 5.213.1)","vendorStatement":{"date":"2026-11-10","url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","quote":"xo-server: version 5.213.1 (latest channel)"}},{"version":"Xen Orchestra Appliance (XOA)","status":"affected","versions":"Update on the stable (6.9.2) or latest (6.10.1) channel","vendorStatement":{"date":"2026-11-10","url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","quote":"Xen Orchestra Appliance: Affected."}},{"version":"Xen Orchestra installed from source","status":"affected","versions":"latest master","vendorStatement":{"date":"2026-11-10","url":"https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/","quote":"If Xen Orchestra was installed from source, it is strongly recommended to update to the latest master"}}]},"pocs":[],"pocEmptyState":"No public PoC indexed as of 11 Nov 2026. GitHub code search for VSA-2026-062 found news aggregators, not an exploit repository. This site does not copy exploit code.","_feed":{"page":"https://vuln2shell.com/vulns/xen-orchestra-auth-bypass-vsa-2026-062","json":"https://vuln2shell.com/vulns/xen-orchestra-auth-bypass-vsa-2026-062.json","iocsCsv":"https://vuln2shell.com/vulns/xen-orchestra-auth-bypass-vsa-2026-062/iocs.csv","stix":"https://vuln2shell.com/vulns/xen-orchestra-auth-bypass-vsa-2026-062/stix.json","badges":{"patch":"Patched","itw":"Exploited in the wild","poc":"No public PoC indexed"}}}