Apache CloudStack CVE-2025-66172

Requires authenticated user account in CloudStack with API access (PR:L). CloudStack Backup plugin must be explicitly enabled on the target installation - this is not a default component and requires administrator configuration. Attacker must have access to specific CloudStack management APIs related to backup operations (exact APIs identified in Apache advisory but require plugin activation). Target environment must have existing user backups stored in the system that contain valuable data. Exploitation is limited to environments running CloudStack versions 4.21.0.0 or 4.22.0.0 specifically - earlier versions lack the Backup plugin entirely, and 4.22.0.1+ contain the fix. Attacker requires knowledge of or ability to enumerate backup identifiers belonging to other tenants. Network access to CloudStack management plane is required (AV:N), but no special user interaction or elevated privileges beyond basic authentication needed.

Real-world risk is significant for multi-tenant CloudStack deployments but limited in scope by prerequisite conditions. CVSS 8.1 (AV:N/AC:L/PR:L/UI:N) indicates network-accessible exploitation requiring only low-privileged authentication with no user interaction, accurately reflecting the technical severity. However, multiple constraining factors reduce immediate risk: EPSS 0.01% (1st percentile) indicates negligible observed exploitation attempts in the wild; SSVC assessment marks exploitation status as 'none' and automatable as 'no', requiring attacker knowledge of specific backup IDs and victim accounts; the vulnerability only affects environments where the Backup plugin is explicitly enabled, not default CloudStack installations. The confidentiality and integrity impact is high (S:U scope unchanged means attacker gains access only within CloudStack context, not underlying infrastructure), but availability is unaffected. No CISA KEV listing and no public POC identified at time of analysis. Primary risk scenario is insider threat or compromised low-privilege accounts in shared hosting environments where Backup plugin is active. Organizations not using the Backup plugin feature are unaffected despite running vulnerable versions.

An attacker with a low-privileged authenticated account in a multi-tenant CloudStack environment enumerates backup identifiers through accessible API endpoints or by guessing sequential backup IDs. Using the vulnerable backup restoration API, the attacker specifies a target backup belonging to another tenant and initiates a restore operation. CloudStack fails to validate backup ownership, successfully creating a volume from the victim's backup data. The attacker then attaches this restored volume to their own VM, gaining read access to the victim's complete backup contents including application data, databases, and potentially credentials or sensitive business information.