Is CVE-2025-66172 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-66172 being exploited in the wild.

How severe is CVE-2025-66172?

High severity, with a CVSS score of 8.1, published 8 May 2026.

Which products and versions are affected?

Apache CloudStack 4.21.0.0 through 4.22.0.0.

Is there a fix for CVE-2025-66172?

A patch was published on 2026-05-08: Fix released in version 4.22.0.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-66172 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-66172?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-66172: The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated…

CVE-2025-66172 · Severity: high · CVSS 8.1 · Published 2026-05-08

Apache CloudStack is an open-source platform used to manage and deploy large networks of virtual machines. A security flaw in its Backup plugin allows any logged-in user to access and restore data from other users' backups. This means an attacker could steal sensitive information by attaching another customer's backup volumes to their own virtual machines.

Quick answers

Is CVE-2025-66172 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-66172 being exploited in the wild.
How severe is CVE-2025-66172?: High severity, with a CVSS score of 8.1, published 8 May 2026.
Which products and versions are affected?: Apache CloudStack 4.21.0.0 through 4.22.0.0.
Is there a fix for CVE-2025-66172?: A patch was published on 2026-05-08: Fix released in version 4.22.0.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-66172 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-66172?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper access control vulnerability (CWE-359) exists in the Apache CloudStack Backup plugin versions 4.21.0.0 and 4.22.0.0. The root cause is flawed access logic within the plugin's API handlers. An authenticated attacker with standard user-level access can invoke specific APIs to restore a volume from a backup belonging to a different user or account. Once restored, the attacker can attach this volume to a virtual machine under their control, leading to unauthorized data disclosure and integrity compromise. The issue is resolved in CloudStack version 4.22.0.1.

Affected products

Apache CloudStack 4.21.0.0 through 4.22.0.0

Timeline

2026-05-08: disclosed: Initial disclosure by Apache Software Foundation
2026-05-08: advisory: NVD publication date
2026-05-08: patched: Fix released in version 4.22.0.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.