VSA-2026-062 Xen Orchestra defensive kit (Cybersecsloth, 2026-11-10)
LAB-ONLY / DEFENSIVE USE. Offline. Reads files you export. Contains no exploit code.
Fixed: xo-server 5.213.1 (latest, XO 6.10.0) and 5.211.2 (stable, XO 6.9.1).
xo-062-audit.py version <xo-server version>
xo-062-audit.py httplog <proxy/access logs or tshark text export>   (needs cookies logged)
xo-062-audit.py xcpng <dir>  dir holds: vm-list.txt (xe vm-list params=name-label,platform),
   xensource.log*, and root/ (copy of etc/ld.so.preload, /.ustar*, etc/cron.d/zz-ustar*) if present
xo-062-mitigate.sh <mgmt-cidr> [--apply]  nftables containment, dry run by default
Source: https://docs.vates.tech/security-advisories/advisories/2026/vates-sa-2026-062/
