Skip to main content

Apache CloudStack EUVD-2026-28549

| CVE-2026-25077 HIGH
Code Injection (CWE-94)
2026-05-08 apache GHSA-vhgc-6rjx-f6vv
RCE Denial Of Service Apache Code Injection
8.8
CVSS 3.1
Share

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

8
Analysis Updated
May 10, 2026 - 15:27 vuln.today
v2 (cvss_changed)
Re-analysis Queued
May 10, 2026 - 15:22 vuln.today
cvss_changed
Severity Changed
May 10, 2026 - 15:22 NVD
MEDIUM HIGH
CVSS changed
May 10, 2026 - 15:22 NVD
6.3 (MEDIUM) 8.8 (HIGH)
Analysis Generated
May 08, 2026 - 18:23 vuln.today
CVSS changed
May 08, 2026 - 18:22 NVD
6.3 (MEDIUM)
CVE Published
May 08, 2026 - 12:21 nvd
MEDIUM 6.3
CVE Published
May 08, 2026 - 12:21 nvd
UNKNOWN (no severity yet)

DescriptionNVD

Account users are allowed by default to register templates to be downloaded directly to the primary storage for deploying instances using the KVM hypervisor. Due to missing file name sanitization, an attacker can register malicious templates to execute arbitrary code on the KVM hosts. This can result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of the KVM-based infrastructure managed by CloudStack.

Users are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, which fixes this issue.

AnalysisAI

Remote code execution in Apache CloudStack allows authenticated account users to execute arbitrary code on KVM hypervisor hosts by registering malicious templates with unsanitized filenames. Affects CloudStack 4.11.0 through 4.20.2.0 and 4.21.0.0 through 4.22.0.0 when using KVM hypervisors. …

Sign in for full analysis, threat intelligence, and remediation guidance.

RemediationAI

Within 24 hours: inventory all CloudStack deployments, identify instances running versions 4.11.0-4.20.2.0 or 4.21.0-4.22.0.0 with KVM hypervisors, and document current versions. Within 7 days: upgrade to patched versions (4.20.3.0 for 4.20.x branch or 4.22.0.1 for 4.22.x branch); coordinate with infrastructure teams to schedule maintenance windows. …

Sign in for detailed remediation steps.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

More from same product – last 7 days

CVE-2025-48977 HIGH
8.5 May 28

Path traversal in Apache Ignite 2.0.0 through 2.17.0 lets authenticated REST API users read arbitrary files on the serve
CVE-2026-42782 HIGH
7.2 May 25

Code execution via Groovy sandbox bypass in Apache Syncope 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0 allows a hig
CVE-2026-43827 MEDIUM
5.9 May 25

Default configurations of Apache Shiro have a session fixation vulnerability. This issue affects Apache Shiro from 1.0

CVE-2026-43828 MEDIUM
5.9 May 25

Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue
CVE-2026-44598 MEDIUM
5.1 May 25

With valid login credentials, URL Redirection to Untrusted Site ('Open Redirect'), Server-Side Request Forgery (SSRF) vu

Share

EUVD-2026-28549 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy