Critical Xen Orchestra Authentication Bypass Exploited in Attacks

SecurityWeek reports, citing software maker Vates, that a threat actor has been exploiting a critical-severity authentication bypass and a zero-day vulnerability in Xen Orchestra, a web-based backup, management and disaster recovery solution for XCP-ng and XenServer environments. Vates says the authentication flaw in the REST authentication mechanism allows unauthenticated attackers to bypass authentication and gain administrator privileges. The affected releases are those before 6.9.2 (stable) and 6.10.1 (latest), and the Xen Orchestra Appliance.

Vates says the zero-day requires administrator privileges and allows malicious VM imports that could compromise XCP-ng hosts, and that a fix is still being developed. The company said the attacker initially operated from 91.211.251.112:8001 and via the Tor network, and that no CVE identifier has been assigned. Vates warns that unauthorized access is not logged and has shared indicators of compromise limited to this campaign.

Vates recommends placing Xen Orchestra instances behind a dedicated network, blocking associated IP addresses and domain names, blocking the empty token in a WAF rule, and rotating all potentially compromised credentials. In case of a confirmed compromise, the company recommends a full reinstallation, as cleanup alone cannot guarantee the removal of all backdoors.

Why it matters Xen Orchestra manages hosts, VMs and storage pools, so compromise of its administrator access can extend to managed XCP-ng nodes. Organizations running affected releases or the Xen Orchestra Appliance should check their versions, restrict network exposure, review credentials and, where compromise is confirmed, plan a full reinstallation as Vates advises. Because unauthorized access is not logged and no fix exists yet for the zero-day, the absence of the published indicators of compromise does not establish that a system is clean.