Apache CloudStack EUVD-2026-63941

Exploitation requires network access to the Apache CloudStack management server API with at least low-privilege authenticated credentials, as confirmed by PR:L in the CVSS 4.0 vector. The AT:P (attack requirements present) metric indicates specific triggering conditions-likely repeated or sustained invocation of scoped configuration code paths within modules such as Quota or Host-HA rather than a single-shot exploit. User interaction (UI:A in the CVSS 4.0 vector) is also required, suggesting that exploitation may depend on a privileged user or automated process actively exercising the affected functionality. The vulnerability is a gradual accumulation rather than an immediate trigger: impact builds over time, so short-lived or infrequent use of affected modules may not produce observable DoS. Unauthenticated remote exploitation is not supported by the available CVSS data. Exploitation is further limited to versions 4.7.0-4.20.3.0 and 4.21.0.0-4.22.1.0; installations already on 4.20.3.1 or 4.22.1.1 are not affected.

The CVSS 4.0 score of 6.8 with vector AV:N/AC:L/AT:P/PR:L/UI:A reflects a network-reachable flaw requiring low-privilege authentication and active user interaction, with AT:P (specific attack conditions required) indicating that exploitation is not trivially automated. The subsequent-system availability impact (SA:H) is the most operationally significant signal: loss of the management server denies administrative control over all hosted workloads, making this a management-plane DoS rather than a data-plane disruption. No EPSS score was supplied, and neither KEV listing nor public exploit code has been identified, suggesting this has not been weaponized at scale. The gradual nature of resource exhaustion provides detection windows-heap or thread pool saturation should surface in monitoring before full collapse-meaning a well-instrumented CloudStack deployment has mitigation options even without immediate patching. Taken together, the real-world urgency is moderate-to-high for production cloud operators: while this is not a remote code execution or data exfiltration risk, any organization running CloudStack as critical infrastructure-even a smaller regional provider-should treat the available patch as a priority upgrade rather than a deferred maintenance item.

An authenticated CloudStack user with low-privilege API access repeatedly invokes management operations that interact with scoped global configuration-for example, querying Quota accounting or triggering Host-HA configuration reads across multiple zones. Each invocation allocates internal resources that are never released, slowly accumulating over hours or days. Eventually the management server's JVM heap or thread pool saturates, rendering it unresponsive and cutting off all administrative and orchestration functions for hosted workloads. No public exploit code has been identified at time of analysis.