{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/xen-orchestra-appliance/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Xen Orchestra (\u003c 6.9.2, \u003c 6.10.1)","Xen Orchestra Appliance"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"threat","_cs_vendors":["Vates"],"content_html":"\u003cp\u003eVates has issued a warning regarding active exploitation of two vulnerabilities in Xen Orchestra, a backup and management solution for XCP-ng and XenServer environments. The first is a critical authentication bypass in the REST API mechanism, triggered by an empty authentication token, which allows attackers to impersonate valid users and gain administrator privileges. The second is an unpatched zero-day vulnerability allowing malicious VM imports that result in host compromise. No CVE identifiers have been assigned to these flaws.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker establishes initial contact via 91.211.251.112:8001 or Tor network.\u003c/li\u003e\n\u003cli\u003eAttacker exploits an empty token vulnerability in the Xen Orchestra REST authentication mechanism to bypass authentication.\u003c/li\u003e\n\u003cli\u003eAttacker gains unauthorized administrator access to the Xen Orchestra interface.\u003c/li\u003e\n\u003cli\u003eAttacker leverages a zero-day vulnerability related to VM imports to gain access to XCP-ng hosts.\u003c/li\u003e\n\u003cli\u003eAttacker executes arbitrary code as root on the underlying virtualization host.\u003c/li\u003e\n\u003cli\u003eAttacker establishes persistent access or backdoors on the compromised virtualization node.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eConfirmed compromise leads to full root-level takeover of XCP-ng virtualization nodes. Cleanup efforts are considered unreliable by the vendor, and a full reinstallation of affected nodes is recommended following a confirmed incident.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Xen Orchestra to version 6.9.2 (stable) or 6.10.1 (latest) or higher immediately.\u003c/li\u003e\n\u003cli\u003eRotate all administrative and service credentials for the Xen Orchestra environment.\u003c/li\u003e\n\u003cli\u003eIsolate Xen Orchestra instances behind a dedicated management network.\u003c/li\u003e\n\u003cli\u003eImplement a WAF rule to block empty authentication tokens in REST API requests.\u003c/li\u003e\n\u003cli\u003eConduct a full reinstallation of systems where compromise is confirmed.\u003c/li\u003e\n\u003cli\u003eBlock communication with the observed malicious infrastructure (91.211.251.112).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T16:44:19Z","date_published":"2026-11-11T16:44:19Z","id":"https://feed.craftedsignal.io/briefs/2026-11-xen-orchestra-flaws/","summary":"A threat actor is actively exploiting a critical authentication bypass in the Xen Orchestra REST API and a separate zero-day vulnerability to achieve root-level code execution on XCP-ng nodes.","title":"Vates Xen Orchestra Authentication Bypass and Zero-Day Exploitation","url":"https://feed.craftedsignal.io/briefs/2026-11-xen-orchestra-flaws/"}],"language":"en","title":"CraftedSignal Threat Feed - Xen Orchestra Appliance","version":"https://jsonfeed.org/version/1.1"}