Critical Authentication Bypass in Vates Xen Orchestra xo-server CVE-2026-113610 Under Active Exploitation

Vates Xen Orchestra xo-server versions before 6.9.0 contain a critical authorization bypass in the user.set API (CVE-2026-113610). Remote unauthenticated attackers exploit the endpoint to bypass authentication and obtain administrative privileges on xo-server, enabling arbitrary code execution and full takeover of managed XCP-ng/XenServer nodes. Active exploitation is confirmed in the wild. Vates patched the flaw in xo-server 6.9.0 via advisory VSA-2026-062. Immediate patching and forensic review of exposed instances are required.

• Vulnerability Overview: CVE-2026-113610

  • CVE ID: CVE-2026-113610; Vendor Advisory: VSA-2026-062; GitHub Advisory: GHSA-22x8-669x-gh7m.
  • Affected component: xo-server; versions prior to 6.9.0.
  • Patched versions: xo-server 6.9.0 and later.
  • Vulnerable endpoint: user.set API.

• Technical Mechanics: Authorization Bypass via user.set API

  • Authorization logic flaw in the user.set API endpoint.
  • Remote, unauthenticated access to xo-server API.
  • Bypasses authentication and grants administrative privileges.
  • Enables arbitrary code execution as admin on xo-server.

• Impact and Exploitation Status

  • Active exploitation confirmed in the wild.
  • Full takeover of XCP-ng/XenServer nodes managed by Xen Orchestra.
  • VM hijacking, host configuration modification, infrastructure compromise.
  • High impact on confidentiality, integrity, and availability.

• Affected Scope and Environments

  • Multi-tenant environments using Xen Orchestra for XCP-ng or XenServer.
  • All VMs and host configurations under xo-server management at risk.
  • Potential disruption of virtualization services and node takeover.

• Detection and Mitigation

  • Upgrade xo-server to version 6.9.0 or later immediately.
  • Apply vendor security advisory VSA-2026-062.
  • Perform forensic analysis of exposed xo-server instances for IOCs.
  • Audit API access logs for unauthorized user.set invocations.

• Conclusion

  • Treat as critical priority due to confirmed active exploitation.
  • Prioritize patching and incident response for virtualization management infrastructure.
  • Assume exposed instances compromised until verified otherwise.