Apache Cloudstack vulnerabilities

65 CVEs affecting Apache Cloudstack, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-59654, published 2026-08-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-41107, published 2024-07-19. High severity, CVSS 8.1. EPSS: 17.8% chance of exploitation in the next 30 days. The CloudStack SAML authentication (disabled by default) does not enforce signature check. In CloudStack environments where SAML authentication is enabled, an attacker that initiates CloudStack SAML…
CVE-2022-35741, published 2022-07-18. Critical severity, CVSS 9.8. EPSS: 8% chance of exploitation in the next 30 days. Apache CloudStack version 4.5.0 and later has a SAML 2.0 authentication Service Provider plugin which is found to be vulnerable to XML external entity (XXE) injection. This plugin is not enabled by…
CVE-2012-4501, published 2012-10-26. High severity, CVSS 10.0. EPSS: 7.8% chance of exploitation in the next 30 days. Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as demonstrated by API calls to delete VMs.
CVE-2013-2758, published 2014-05-23. Medium severity, CVSS 5.0. EPSS: 6.5% chance of exploitation in the next 30 days. Apache CloudStack 4.0.0 before 4.0.2 and Citrix CloudPlatform (formerly Citrix CloudStack) 3.0.x before 3.0.6 Patch C uses a hash of a predictable sequence, which makes it easier for remote attackers…
CVE-2013-2756, published 2014-05-23. Medium severity, CVSS 5.0. EPSS: 5.8% chance of exploitation in the next 30 days. Apache CloudStack 4.0.0 before 4.0.2 and Citrix CloudPlatform (formerly Citrix CloudStack) 3.0.x before 3.0.6 Patch C allows remote attackers to bypass the console proxy authentication by leveraging…
CVE-2016-6813, published 2018-02-06. Critical severity, CVSS 9.8. EPSS: 5.6% chance of exploitation in the next 30 days. Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer API. If a malicious user is able to determine the ID of another (non-"root")…
CVE-2013-2136, published 2013-08-19. Medium severity, CVSS 4.3. EPSS: 4.1% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in Apache CloudStack before 4.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Physical network name to the Zone…
CVE-2013-6398, published 2014-01-15. Low severity, CVSS 2.8. EPSS: 3.7% chance of exploitation in the next 30 days. The virtual router in Apache CloudStack before 4.2.1 does not preserve the source restrictions in firewall rules after being restarted, which allows remote attackers to bypass intended restrictions…
CVE-2024-38346, published 2024-07-05. Critical severity, CVSS 9.8. EPSS: 3.3% chance of exploitation in the next 30 days. The CloudStack cluster service runs on unauthenticated port (default 9090) that can be misused to run arbitrary commands on targeted hypervisors and CloudStack management server hosts. Some of these…
CVE-2014-9593, published 2015-01-15. Medium severity, CVSS 5.0. EPSS: 3.2% chance of exploitation in the next 30 days. Apache CloudStack before 4.3.2 and 4.4.x before 4.4.2 allows remote attackers to obtain private keys via a listSslCerts API call.

Latest

CVE-2026-59654, published 2026-08-21. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack…
CVE-2026-68745, published 2026-08-21. High severity, CVSS 8.1. EPSS: 0.2% chance of exploitation in the next 30 days. Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow a malicious agent to forge a SAML response to the management server. The agent…
CVE-2026-66797, published 2026-08-21. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure. The addAnnotation and listAnnotation APIs perform an ownership check when an…
CVE-2026-66722, published 2026-08-21. High severity, CVSS 7.2. EPSS: 0.6% chance of exploitation in the next 30 days. Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack. A Domain Admin can create, update, delete, and list project roles and…
CVE-2026-66721, published 2026-08-21. Low severity, CVSS 2.7. EPSS: 0.5% chance of exploitation in the next 30 days. Missing authorization issue for domain admins in CloudStack's host tags listing functionality. Domain Admins, by default, have permission to call the listHostTags API, but the API returns host…
CVE-2026-65613, published 2026-08-21. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries. This issue affects Apache CloudStack: from…
CVE-2026-62440, published 2026-08-21. Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days. Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin, allowing cross-tenant manipulation of the Kubernetes cluster while adding and removing nodes. This issue…
CVE-2026-61422, published 2026-08-21. Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days. Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality. When registering a template or ISO, CloudStack makes a live HTTP HEAD/GET call to…
CVE-2026-61400, published 2026-08-21. High severity, CVSS 8.8. EPSS: 2.9% chance of exploitation in the next 30 days. Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache CloudStack's run and get diagnostics functionality for the system VMs and virtual…
CVE-2026-61399, published 2026-08-21. Medium severity, CVSS 4.8. EPSS: 0.5% chance of exploitation in the next 30 days. Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from…