Improper Access Control in Xen Orchestra by Vates S.A.

CVE-2026-110111

What is CVE-2026-110111?

An improper access control vulnerability in Xen Orchestra prior to version 6.9.0 allows any authenticated user to escalate their privileges to that of a global administrator. This exploitation occurs through the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can direct the xo-server to a malicious ESXi host that serves a specially crafted .vmx file with proto.permission set, leading to pollution of the Object.prototype. Consequently, accounts lacking adequate permissions can unintentionally inherit admin rights, posing significant security risks including the potential for remote code execution.

References