{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/xen-orchestra--6.9.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:vates:xen_orchestra:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-110111"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Xen Orchestra (\u003c 6.9.0)"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","remote-code-execution","web-application","xen-orchestra"],"_cs_type":"advisory","_cs_vendors":["Vates"],"content_html":"\u003cp\u003eXen Orchestra versions prior to 6.9.0 contain an improper access control vulnerability identified as CVE-2026-110111. The vulnerability exists within the 'vm.importFromEsxi' and 'vm.importMultipleFromEsxi' methods, which are used to import virtual machines. An authenticated attacker can exploit this flaw by pointing the 'xo-server' component to a malicious ESXi host controlled by the attacker. By serving a crafted '.vmx' file containing a '\u003cstrong\u003eproto\u003c/strong\u003e.permission' property, the attacker triggers a prototype pollution attack. This pollution forces 'Object.prototype' to inherit administrative permissions, effectively granting the authenticated user global administrator rights within the Xen Orchestra instance. This escalation can be further leveraged to achieve remote code execution. Given the impact on administrative access control, this vulnerability represents a significant risk for environments utilizing Xen Orchestra for management of virtual infrastructure.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker obtains valid low-privileged authentication credentials for the target Xen Orchestra instance.\u003c/li\u003e\n\u003cli\u003eAttacker prepares a rogue ESXi host that hosts a specially crafted .vmx virtual machine definition file.\u003c/li\u003e\n\u003cli\u003eThe .vmx file is injected with the malicious '\u003cstrong\u003eproto\u003c/strong\u003e.permission' property to facilitate prototype pollution.\u003c/li\u003e\n\u003cli\u003eAttacker invokes the 'vm.importFromEsxi' or 'vm.importMultipleFromEsxi' method via the Xen Orchestra API or web interface, specifying the attacker-controlled ESXi host.\u003c/li\u003e\n\u003cli\u003eThe 'xo-server' component processes the malicious .vmx file, resulting in the successful pollution of 'Object.prototype'.\u003c/li\u003e\n\u003cli\u003eThe application incorrectly validates user permissions against the polluted prototype, elevating the attacker's session to global administrator.\u003c/li\u003e\n\u003cli\u003eAttacker uses the elevated administrative privileges to execute arbitrary commands or configure the virtual infrastructure, resulting in full compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows any authenticated user to achieve global administrator privileges within the Xen Orchestra management platform. This bypass of access controls leads to a total loss of confidentiality and integrity of the managed virtual environment, as the attacker can perform unauthorized administrative actions, manipulate virtual machines, or achieve remote code execution on the server hosting the Xen Orchestra management software.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Xen Orchestra to version 6.9.0 or later immediately to patch the vulnerable import methods.\u003c/li\u003e\n\u003cli\u003eRestrict network access to the Xen Orchestra API and management interface to trusted administrative subnets only.\u003c/li\u003e\n\u003cli\u003eImplement monitoring of API calls to 'vm.importFromEsxi' and 'vm.importMultipleFromEsxi' to detect attempts to reach unknown or non-standard ESXi management endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T04:36:18Z","date_published":"2026-10-14T04:36:18Z","id":"https://feed.craftedsignal.io/briefs/2026-10-xen-orchestra-privilege-escalation/","summary":"Xen Orchestra versions prior to 6.9.0 are vulnerable to privilege escalation via prototype pollution in ESXi import methods, allowing authenticated users to gain global administrator rights.","title":"CVE-2026-110111: Improper Access Control in Xen Orchestra","url":"https://feed.craftedsignal.io/briefs/2026-10-xen-orchestra-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - Xen Orchestra (\u003c 6.9.0)","version":"https://jsonfeed.org/version/1.1"}