CVE-2026-110111

Awaiting Analysis Awaiting Analysis - Queue

Improper Access Control in Xen Orchestra Leading to Privilege Escalation

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description

Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a crafted .vmx file with __proto__.permission set, polluting Object.prototype so permission-less accounts inherit admin rights and enabling remote code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110111

EUVD

EUVD-2026-100463

Affected Vendors & Products

Vendor	Product	Version / Range
vatesfr	xen-orchestra	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1321	The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

Executive Summary

CVE-2026-110111 is a privilege escalation vulnerability in Xen Orchestra versions before 6.9.0. It allows any authenticated user to become a global administrator by exploiting improper access control in the vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can use a malicious ESXi host serving a crafted .vmx file with __proto__.permission set to pollute Object.prototype, granting admin rights to permission-less accounts and enabling remote code execution.

Detection Guidance

To detect this vulnerability, check if your Xen Orchestra version is prior to 6.9.0. Inspect API logs for unauthorized calls to vm.importFromEsxi or vm.importMultipleFromEsxi methods. Look for unusual .vmx file imports from untrusted ESXi hosts. Monitor for unexpected privilege escalations or admin account changes.

Impact Analysis

This vulnerability allows attackers to gain full control over the Xen Orchestra server, including stealing configuration secrets, executing arbitrary jobs, and managing XenServer/XCP-ng environments. It can also disable 2FA, cause permanent login denial-of-service, or enumerate users without needing the victim's password.

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA due to unauthorized privilege escalation and remote code execution. Attackers gaining global admin rights could access, modify, or exfiltrate sensitive data, violating confidentiality requirements. The flaw enables full compromise of the Xen Orchestra server, including configuration and secrets theft, which may lead to unauthorized data processing or disclosure.

Mitigation Strategies

Immediately upgrade Xen Orchestra to version 6.9.0 or later. Disable the vm.importFromEsxi and vm.importMultipleFromEsxi methods if not needed. Restrict network access to the Xen Orchestra server. Review and remove any unauthorized admin accounts or permissions. Monitor for persistent backdoors after mitigation.

Hi! I’m here to help you understand CVE-2026-110111. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70