[NEW] [high] Apache CloudStack: Multiple vulnerabilities

CSIRTS triage

What

Multiple vulnerabilities in Apache CloudStack enable arbitrary code execution with admin privileges, information disclosure, file manipulation, cross-site scripting, authentication bypass, and code execution.

Who is affected

Apache CloudStack deployments.

Urgency

High: severity rated high; administrative privilege code execution requires immediate remediation.

Action

Apply available Apache CloudStack security updates; review CloudStack advisories for affected versions and patches.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

CERT-Bund (BSI) Security Advisories (DE · national-cert · site)

Severity

high

Published

2026-08-24

Exploitation

Not in CISA KEV at last sync

Language

Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2962

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-473590.51% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 42% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-501120.32% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 24% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-502220.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-590850.14% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-596550.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 7% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-596570.10% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 1% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-597800.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 7% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-597990.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-613970.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 7% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-613980.14% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all EPSS-scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• highCVE-2026-68745: Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.…nvd
• mediumCVE-2026-66797: Improper access control in CloudStack's annotation functionality allows unauthorized comment c…nvd
• highCVE-2026-66722: Improper authorization for CRUD operations on Project Roles and Project Role permissions for d…nvd
• lowCVE-2026-66721: Missing authorization issue for domain admins in CloudStack's host tags listing functionality.…nvd
• mediumCVE-2026-65613: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack'…nvd
• criticalCVE-2026-62440: Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin, …nvd
• mediumCVE-2026-61422: Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO regist…nvd
• highCVE-2026-61400: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerabil…nvd
• mediumCVE-2026-61399: Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lo…nvd
• criticalCVE-2026-61398: Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using In…nvd
• highCVE-2026-61397: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack'…nvd
• highCVE-2026-59799: Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication p…nvd

Recent advisories for Apache CloudStack

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• medium[NEW] [medium] Apache CloudStack: Vulnerability allows denial of servicecert-bund · 2026-08-24
• unknownCVE-2026-59654: Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scop…nvd · 2026-08-21
• highCVE-2026-68745: Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.…nvd · 2026-08-21
• mediumCVE-2026-65613: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack'…nvd · 2026-08-21
• criticalCVE-2026-62440: Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin, …nvd · 2026-08-21
• mediumCVE-2026-61422: Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO regist…nvd · 2026-08-21

More from CERT-Bund (BSI) Security Advisories

• high[NEW] [high] Linux Kernel: Multiple vulnerabilities2026-08-25
• medium[NEW] [medium] libTIFF: Multiple Vulnerabilities2026-08-25
• high[NEW] [high] Contao: Multiple Vulnerabilities2026-08-25
• medium[NEW] [medium] Django: Multiple Vulnerabilities2026-08-25
• high[NEW] [high] Red Hat Enterprise Linux (Apicurio Registry): Multiple Vulnerabilities2026-08-25