CVE-2026-110111
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a crafted .vmx file with __proto__.permission set, polluting Object.prototype so permission-less accounts inherit admin rights and enabling remote code execution.
Risk Assessment
The risk is that any authenticated user can gain full administrator privileges, potentially leading to complete system compromise, data breaches, and remote code execution.
Recommendation
It is recommended to immediately upgrade Xen Orchestra to version 6.9.0 or later and secure the ESXi import methods with proper access control.
Other vulnerabilities in Xen Orchestra
Original NVD description (English source)
Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a crafted .vmx file with __proto__.permission set, polluting Object.prototype so permission-less accounts inherit admin rights and enabling remote code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS