SockAnalyst
← All playbooks
CriticalExploited vuln · 2026-11-11

Xen Orchestra VSA-2026-062: empty-object login cookie gives attackers admin and root on XCP-ng hosts, exploited in the wild

SockAnalyst · Security+ certified analyst.

What happened

On November 10, 2026 Vates published VSA-2026-062, a Critical authentication bypass in Xen Orchestra and the Xen Orchestra Appliance (XOA) that it says is actively exploited. REST cookie parsing turns authenticationToken=j:%7B%7D into an empty object {}; the token store treats that as an unfiltered lookup, returns the first unexpired token and logs the attacker in as that token's owner. The attacker can then list reusable login tokens and act with Admin privileges, which Vates says can lead to code execution on managed pools and full root takeover of XCP-ng hosts. No CVE ID or CVSS score had been assigned when we checked. Vates says there is no log of the unauthenticated access, published attacker infrastructure and host artifacts, and recommends a full reinstall after confirmed compromise.

Who's affected

Anyone running Xen Orchestra before 6.9.2 (stable) or 6.10.1 (latest), any unpatched Xen Orchestra Appliance, and source installs not updated to current master. Instances reachable from the internet are at highest risk.

✅ Fix / patch

  • Update XOA to 6.10.1 (latest channel) or 6.9.2 (stable channel); fixed packages are xo-server 5.213.1 and 5.211.2. Source installs: update to the latest master (PR #10748), rebuild and restart xo-server.
  • Take Xen Orchestra off the internet: put it on a dedicated management network, VPN or IP allowlist.
  • Block the empty token in a WAF or reverse proxy (authenticationToken=j:{} and authenticationToken=j:%7B%7D); Vates warns regex rules can be bypassed with other encodings, so treat this as a stopgap.
  • Block ingress and egress to the attacker IPs Vates listed and block Tor traffic.
  • Revoke all sessions and API tokens. If compromise is suspected, rotate XCP-ng root passwords and pool secrets, XO proxy and backup-remote credentials, user passwords and OTP secrets; Vates recommends a full reinstall after a confirmed compromise.

🔎 Quick hunt check

Vates published network and host IOCs for this campaign, but warns other actors may use different infrastructure and that absence of IOCs does not prove a clean system. Look for the empty-object cookie in proxy or packet captures, traffic to the listed IPs or Tor, a running VM named pivot2, VMs configured with hvm_serial: file, and the zz-ustar cron files on XCP-ng hosts. On hosts, Vates suggests: xe vm-list params=name-label,platform | grep -B1 'hvm_serial: file' and ls -la /etc/ld.so.preload /.ustar* /etc/cron.d/zz-ustar*.

MITRE ATT&CK: T1190, T1550.001, T1053.003, T1090.003

IOCs

  • IP addresses: 91.211.251[.]112:8001, 193.148.56[.]72, 37.221.208[.]216, 45.66.35[.]11, 64.65.0[.]120, 64.65.62[.]160, 89.47.51[.]90, 92.60.37[.]247
  • Domains: ustar3rqxgnskzgnwkgpofgtvxevm6cx3lxdbwt4mndtveqyaohid[.]onion:3333
  • Files / paths: /etc/cron.d/zz-ustar2, /etc/cron.d/zz-ustar, /.ustar5, /.ustar6

All indicators from the Vates VSA-2026-062 advisory (defanged). Also look for a running VM named pivot2, VMs with hvm_serial: file, and HTTP cookies authenticationToken=j:{} or j:%7B%7D. Vates says these cover only this campaign.

Hunt queries

Starting points built only from published indicators. Field names vary; tune before use.

(index=proxy OR index=web OR index=network) (cookie="*authenticationToken=j:%7B%7D*" OR cookie="*authenticationToken=j:{}*" OR uri="*/rest/v0/users/me/authentication_tokens*")
| stats count min(_time) as first_seen values(uri) as uris by src_ip, dest_ip, http_user_agent
| append [ search (index=firewall OR index=network) (dest_ip IN ("91.211.251.112","193.148.56.72","37.221.208.216","45.66.35.11","64.65.0.120","64.65.62.160","89.47.51.90","92.60.37.247") OR src_ip IN ("91.211.251.112","193.148.56.72","37.221.208.216","45.66.35.11","64.65.0.120","64.65.62.160","89.47.51.90","92.60.37.247")) | stats count by src_ip, dest_ip, dest_port ]
| append [ search index=linux (source="/var/log/xensource.log*" "-serial file:") OR ("zz-ustar" OR ".ustar5" OR ".ustar6" OR "pivot2") | stats count values(_raw) as evidence by host ]
// Xen Orchestra VSA-2026-062: empty-object cookie, Vates-listed C2 IPs, and XCP-ng host artifacts
let XoC2 = dynamic(["91.211.251.112","193.148.56.72","37.221.208.216","45.66.35.11","64.65.0.120","64.65.62.160","89.47.51.90","92.60.37.247"]);
union
(CommonSecurityLog
 | where TimeGenerated > ago(30d)
 | where RequestURL has "/rest/v0" and (RequestCookies has "authenticationToken=j:%7B%7D" or RequestCookies has "authenticationToken=j:{}" or RequestURL has "/users/me/authentication_tokens")
 | project TimeGenerated, SourceIP, DestinationIP, RequestURL, Detail="XO empty-object cookie or token listing"),
(CommonSecurityLog
 | where TimeGenerated > ago(30d)
 | where SourceIP in (XoC2) or DestinationIP in (XoC2)
 | project TimeGenerated, SourceIP, DestinationIP, RequestURL=tostring(DestinationPort), Detail="Traffic with Vates-listed attacker IP"),
(Syslog
 | where TimeGenerated > ago(30d)
 | where SyslogMessage has_any ("zz-ustar", ".ustar5", ".ustar6", "pivot2", "-serial file:")
 | project TimeGenerated, SourceIP=HostIP, DestinationIP="", RequestURL="", Detail=SyslogMessage)
// Xen Orchestra VSA-2026-062 exploitation hunt (Vates IOCs)

See all hunt queries →

⏱ CISA deadline

Not in CISA KEV as of Nov 14, 2026.

Sources

Related playbooks

Get the Weekly KEV & Hunt Pack free — plus the daily SOC brief.

Weekly email; daily brief on the website.

Subscribe free

Read the free weekly pack →