VSA-2026-063: Xen Orchestra VM import flaw exploited, no fix

Call: Patch now, and lock down imports. Vates says the attacker behind VSA-2026-062 also abused a second flaw, VSA-2026-063, to compromise XCP-ng hosts with crafted VM imports. There’s no fix yet. Vates lists Xen Orchestra 6.10.1 and earlier as affected and says it is “actively working on a fix.” Install the VSA-062 fix (6.9.2 stable or 6.10.1 latest) to close the unauthenticated way in. Then take import rights away from everyone who isn’t an admin.

What breaks: Xen Orchestra hands imports to XAPI as pool-admin and passes the XVA’s ova.xml straight through without reading it. So anyone allowed to import can set keys like VBD.other_config:backend-local, VM.other-config:is_system_domain and VM.platform:hvm_serial. Those are the tricks from XSA-489 and XSA-530. Other fields in VM.other_config, VM.platform, VM.ha_restart_priority and VM.appliance are open too. Vates rates it Important. There’s no CVE or CVSS score yet.

How it was used: Vates says the same actor (91.211.251.112:8001, plus a Tor .onion) went down this path with the Admin rights it got from VSA-062. The VSA-062 indicators include VMs with hvm_serial: file set, and VM.platform:hvm_serial is one of the keys this flaw lets an importer set. The worse part is that admin isn’t required. Vates says an unprivileged user with the right permission “could import a malicious VM (XVA) using a crafted keys parameter to compromise an XCP-ng host.”

Who’s hit: Every Xen Orchestra and XOA install, including ones fully patched for VSA-062. The highest risk is delegated users who hold vm.import (JSON-RPC), sr/import:vm (REST API), network/action:create or network/action:update.

Workaround:

Vates’s mitigation: allow VM imports for Admin users only, and disable any user who has one of those four privileges.
Update for VSA-062 if you haven’t, and keep its other steps in place: XO off the internet, the C2 addresses and Tor blocked, a WAF rule for the empty token.
Look for the VSA-062 indicators on every host: a VM named pivot2, hvm_serial: file in VM platform settings, and /etc/cron.d/zz-ustar* or /.ustar* files. If you find any, rotate every secret XO holds and reinstall. Vates says cleanup alone can’t be trusted.

We’ll update this when Vates ships the fix.

Sources: Vates VSA-2026-063 (opens in a new tab), Vates VSA-2026-062 (opens in a new tab), SecurityWeek (opens in a new tab).

VSA-2026-063: Xen Orchestra VM import flaw exploited, no fix

Sources

More from November 2026 patch cycle