Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin Access

A critical authentication bypass vulnerability in Xen Orchestra, tracked as VSA-2026-062 and not yet assigned a CVE, is being actively exploited in the wild. The flaw allows attackers to bypass authentication by sending a specially crafted cookie (authenticationToken=j:%7B%7D), leading to admin-level access and arbitrary code execution on managed XCP-ng nodes. Malicious activity has been linked to an IP address and a TOR domain used as a C2 server for RedLine Stealer. Indicators include specific virtual machine names, cron files, and configuration parameters. Patches are available in Xen Orchestra 6.9.1 and 6.10.0, and xo-server versions 5.211.2 and 5.213.1.

AI-extracted · verify before operational use