Apache CloudStack EUVD-2026-28550

Exploitation requires that the target CloudStack deployment uses the Proxmox hypervisor extension - deployments using KVM, VMware, XenServer, or other hypervisors are not vulnerable. The attacker must have network access to the CloudStack API endpoint and either valid tenant credentials or exploit unauthenticated API access if misconfigured (CVSS vector indicates PR:N but typical IaaS platforms enforce authentication). The 'user.vm.denied.details' configuration parameter must NOT include 'proxmox_vmid' in its restriction list (default configuration allows user editing). Exploitation does NOT require administrative privileges, special hypervisor configurations, or user interaction. The vulnerability is limited to CloudStack 4.21.0.0 through 4.22.0.0 and does not affect earlier versions lacking the Proxmox extension or later patched versions. Cross-tenant isolation via network segmentation or firewalls does NOT prevent exploitation since the attack manipulates CloudStack's control plane, not data plane network traffic.

Real-world risk is CRITICAL for multi-tenant CloudStack deployments using the Proxmox extension. The CVSS 9.1 score accurately reflects severity: network attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), with high confidentiality and integrity impact. The S:U (unchanged scope) understates the cross-tenant boundary violation, which in practice represents a catastrophic multi-tenancy failure. EPSS probability and KEV status are unavailable, preventing assessment of active exploitation trends. However, the attack requires only knowledge of the API endpoint and predictable VM ID enumeration - both trivial for authenticated or unauthenticated attackers who can call CloudStack APIs. The vulnerability is NOT automatable at scale without CloudStack API access, but once accessed, exploitation is trivial. Apache's prompt public disclosure (EUVD-2026-28550) and patch release suggest vendor awareness of exploitation risk. CRITICAL MISSING DATA: No information on whether default CloudStack installations expose the API endpoint unauthenticated (CVSS assumes PR:N, but typical IaaS platforms require authentication for VM management). If authentication is required in practice, real-world exploitability drops significantly - defenders should verify their deployment's API authentication posture.

An attacker with access to a CloudStack tenant account (or exploiting unauthenticated API access if exposed) enumerates Proxmox VM IDs by incrementing numeric values starting from common ranges (e.g., 100-999). Using the CloudStack API, the attacker modifies the 'proxmox_vmid' instance detail of their own VM to reference a target VM ID belonging to another tenant. The attacker then issues legitimate CloudStack management commands (start, stop, reboot, destroy) which CloudStack executes against the victim's VM due to the manipulated reference, achieving full control without triggering authentication or authorization failures.