Is CVE-2026-66722 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66722 being exploited in the wild.

How severe is CVE-2026-66722?

High severity, with a CVSS score of 7.2, published 21 August 2026.

Which products and versions are affected?

Apache Cloudstack 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0.

Is there a fix for CVE-2026-66722?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-66722 attacked?

It is attacked over the network.

Am I affected by CVE-2026-66722?

Check whether you run Apache Cloudstack at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66722: Apache CloudStack improper authorization in project role management

CVE-2026-66722 · Severity: high · CVSS 7.2 · Published 2026-08-21

Apache CloudStack is an open-source cloud infrastructure platform used to manage virtual machines and cloud resources. A Domain Admin account can improperly modify project roles and permissions across unrelated domains, allowing unauthorized tampering with access controls for cloud projects beyond their administrative scope. This breaks the intended isolation between cloud domains and could enable privilege escalation or lateral movement between isolated cloud environments.

Technologies: Apache Cloudstack. Vendors: Apache.

Quick answers

Is CVE-2026-66722 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66722 being exploited in the wild.
How severe is CVE-2026-66722?: High severity, with a CVSS score of 7.2, published 21 August 2026.
Which products and versions are affected?: Apache Cloudstack 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0.
Is there a fix for CVE-2026-66722?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-66722 attacked?: It is attacked over the network.
Am I affected by CVE-2026-66722?: Check whether you run Apache Cloudstack at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper authorization flaw in CloudStack's CRUD operations for project roles and project role permissions. The vulnerable code checks only whether the caller holds a Domain Admin role but fails to verify that the target project belongs to the caller's domain or subdomain. An attacker with Domain Admin privileges can craft requests to create, update, delete, or list project roles and permissions in any domain. Exploitation requires valid Domain Admin credentials and network access to the CloudStack API. Fixes are available in versions 4.20.3.1 and 4.22.1.1 or later.

Affected products

Apache CloudStack 4.15.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0

Timeline

2026-08-21: disclosed

References

https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.