Apache CloudStack EUVD-2026-28549

Attacker must possess valid CloudStack account credentials with template registration permissions (PR:L indicates low-privileged authenticated access). The target CloudStack deployment must use KVM as the hypervisor technology, as the vulnerability specifically affects template downloads to KVM primary storage - deployments using VMware vSphere, XenServer, or other supported hypervisors are not affected by this attack vector. The CloudStack configuration must allow account users to register templates for direct download to primary storage, which is the default configuration per the vulnerability description. Exploitation is limited by the requirement for authenticated access and the specific hypervisor technology, but once these conditions are met, attack complexity is low (AC:L) with no user interaction required (UI:N). These prerequisites significantly narrow the attack surface compared to unauthenticated remote vulnerabilities, making this a targeted threat primarily for multi-tenant KVM-based CloudStack environments where untrusted users have account access.

The CVSS 8.8 score (AV:N/AC:L/PR:L/UI:N) indicates network-exploitable vulnerability with low attack complexity requiring only low-privileged authentication. However, multiple risk signals provide critical context. EPSS score of 0.04% (11th percentile) suggests very low probability of exploitation in the wild. CISA SSVC framework reports no exploitation observed, not automatable, with partial technical impact. The CVSS score reflects worst-case scenario impact on KVM infrastructure, but real-world risk is significantly constrained by exploitation prerequisites: attacker must have valid CloudStack account credentials AND the deployment must use KVM hypervisors (not VMware, XenServer, or other supported platforms). The 'low privilege' requirement means any authenticated user can exploit this, not just administrators, elevating concern for multi-tenant environments. Vendor patches are confirmed available (4.20.3.0, 4.22.0.1) per Apache advisory. This represents a serious vulnerability for KVM-based CloudStack deployments but current exploitation risk appears theoretical rather than active. Priority should be HIGH for KVM environments with untrusted account users, MEDIUM for single-tenant KVM deployments, LOW for non-KVM hypervisor deployments.

An authenticated CloudStack account user with standard privileges accesses the template registration interface and submits a malicious template URL with a crafted filename containing code injection sequences (e.g., command substitution or path traversal with executable content). When CloudStack processes this registration to download the template directly to KVM primary storage, the unsanitized filename executes arbitrary commands on the KVM hypervisor host with the privileges of the CloudStack agent process. The attacker gains code execution on the hypervisor infrastructure, potentially compromising all virtual machines on that host, exfiltrating data from primary storage, or disrupting cloud services. No public proof-of-concept code is identified at time of analysis, but the attack technique is straightforward for anyone with CloudStack account access.