Critical Xen Orchestra Auth Bypass (VSA-2026-062): How Attackers Seized Root Control of Entire Hypervisor Fleets
In November 2026, threat actors began actively exploiting a critical authentication bypass vulnerability (VSA-2026-062) in Vates VMS's Xen Orchestra virtualization management platform. By sending a specially crafted cookie containing an empty JSON object as the authentication token, attackers could bypass all authentication controls and obtain full administrative privileges without valid credentials. Once inside, adversaries achieved arbitrary code execution on managed hypervisor pools and complete root-level takeover of XCP-ng nodes. Active exploitation was confirmed via a known RedLine Stealer C2 IP address and a TOR-based exfiltration endpoint, with forensic indicators including rogue virtual machines and persistent cron-based backdoors deployed across compromised infrastructure. This incident underscores a broader trend of attackers targeting virtualization management planes—the control layer governing entire server fleets—where a single authentication flaw translates directly into full infrastructure compromise. As enterprises consolidate workloads onto hypervisor platforms, unauthenticated admin-level access vulnerabilities in these systems represent maximum-blast-radius risks that demand immediate patching, network segmentation, and internet exposure controls.
Kill Chain
