---
id: CVE-2026-110111
title: >-
  Xen Orchestra before 6.9.0 contains an improper access control vulnerability
  that allows any authenticated user to become global administrator by abusing
  the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods
summary: >-
  Xen Orchestra before 6.9.0 contains an improper access control vulnerability
  that allows any authenticated user to become global administrator by abusing
  the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods.
  Attackers …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-1321
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T19:30:29.797'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-110111'
references:
  - url: >-
      https://github.com/vatesfr/xen-orchestra/security/advisories/GHSA-mc4m-hc98-rhmv
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/xen-orchestra-before-6.9.0-privilege-escalation-via-prototype-pollution-in-vm-importfromesxi
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-13T19:43:28.932Z'
---

## Overview

Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a crafted .vmx file with __proto__.permission set, polluting Object.prototype so permission-less accounts inherit admin rights and enabling remote code execution.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.