CriticalVulnerabilityActiveExploitedPatch available
Attackers exploit Xen Orchestra empty-object login token flaw VSA-2026-062 to gain admin rights without credentials and take over XCP-ng hosts as root
France-based Vates published Xen Orchestra security advisory VSA-2026-062 on November 10, saying the REST API treats a cookie such as authenticationToken=j:%7B%7D, which holds an empty object, as an unfiltered lookup and logs the caller in as the owner of the first unexpired token, and confirmed the flaw is being actively exploited .