OpenNebula EUVD-2025-209587

Upgrade to OpenNebula 7, as the reference to https://opennebula.io/opennebula-7/ in the vulnerability disclosure implies version 7 addresses this issue; however, a specific patched release number and corresponding vendor advisory have not been independently confirmed from available data - verify against official OpenNebula release notes before deploying. As a compensating control, restrict access to the Sunstone web portal (typically exposed on port 9869 or via reverse proxy on 80/443) to trusted internal networks or VPN-connected clients, reducing the population of potential victims who can receive crafted payloads. If the OpenNebula deployment supports configuring HTTP response headers, adding a restrictive Content-Security-Policy header can reduce the impact of injected scripts by limiting permitted script sources; note this is a mitigation, not a fix, and header support depends on the reverse proxy or web server in front of Sunstone. Restricting network access does not remediate the vulnerability and does not protect against internal threat actors. The VulDB advisory at https://vuldb.com/vuln/360181 and the PoC repository at https://github.com/MarkArtamonov/OpenNebula-CVE-2025-56534 should be monitored for updated patch information.