What’s Vulnerable › Vulnerabilities

CVE-2026-110111: Xen Orchestra before 6.9.0 Privilege Escalation via Prototype Pollution in vm.importFromEsxi

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-13 · updated 2026-10-26
• Weakness: CWE-1321

Description

Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a crafted .vmx file with __proto__.permission set, polluting Object.prototype so permission-less accounts inherit admin rights and enabling remote code execution.

Affected products

• vatesfr xen-orchestra: before 6.9.0 — fixed in 6.9.0

How to fix

Upgrade to a fixed version: vatesfr xen-orchestra 6.9.0. Check the vendor advisory for mitigations.

References

• https://github.com/vatesfr/xen-orchestra/security/advisories/GHSA-mc4m-hc98-rhmv
• https://www.vulncheck.com/advisories/xen-orchestra-before-6.9.0-privilege-escalation-via-prototype-pollution-in-vm-importfromesxi

Get alerted when CVE-2026-110111 or the next vulnerability affects your stack