# Apache CloudStack vulnerabilities Source: https://junglewise.ai/threats/technologies/cloudstack Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/cloudstack.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 28 vulnerabilities in Apache CloudStack: 0 in the last 7 days and 20 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-59654, was published on 21 August 2026. Nothing was published in the last eight weeks. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 20 - All time: 28 (4 critical, 0 exploited in the wild) ## About Apache CloudStack Open source Infrastructure as a Service (IaaS) cloud computing platform for managing and orchestrating virtual machines and cloud resources. ## Latest Apache CloudStack vulnerabilities - [CVE-2026-59654: Apache CloudStack resource leak in scoped global configuration](https://junglewise.ai/threats/cve-2026-59654-apache-cloudstack-resource-leak-in-scoped-global-configuration) (high, CVSS 7.5, published 21 Aug 2026) - [CVE-2026-68745: Apache CloudStack certificate validation bypass in SAML authentication](https://junglewise.ai/threats/cve-2026-68745-apache-cloudstack-certificate-validation-bypass-in-saml) (high, CVSS 8.1, published 21 Aug 2026) - [CVE-2026-66797: Apache CloudStack improper access control in annotation APIs](https://junglewise.ai/threats/cve-2026-66797-apache-cloudstack-improper-access-control-in-annotation-apis) (medium, CVSS 5.4, published 21 Aug 2026) - [CVE-2026-66722: Apache CloudStack improper authorization in project role management](https://junglewise.ai/threats/cve-2026-66722-apache-cloudstack-improper-authorization-in-project-role) (high, CVSS 7.2, published 21 Aug 2026) - [CVE-2026-66721: Apache CloudStack authorization bypass in host tags listing](https://junglewise.ai/threats/cve-2026-66721-apache-cloudstack-authorization-bypass-in-host-tags-listing) (low, CVSS 2.7, published 21 Aug 2026) - [CVE-2026-65613: Apache CloudStack information disclosure in Webhook module](https://junglewise.ai/threats/cve-2026-65613-apache-cloudstack-information-disclosure-in-webhook-module) (medium, CVSS 4.3, published 21 Aug 2026) - [CVE-2026-62440: Apache CloudStack improper access control in Kubernetes Service plugin](https://junglewise.ai/threats/cve-2026-62440-apache-cloudstack-improper-access-control-in-kubernetes-service) (critical, CVSS 9.1, published 21 Aug 2026) - [CVE-2026-61422: Apache CloudStack SSRF in template and ISO registration](https://junglewise.ai/threats/cve-2026-61422-apache-cloudstack-ssrf-in-template-and-iso-registration) (medium, CVSS 4.3, published 21 Aug 2026) - [CVE-2026-61400: Apache CloudStack command injection in diagnostics API](https://junglewise.ai/threats/cve-2026-61400-apache-cloudstack-command-injection-in-diagnostics-api) (high, CVSS 8.8, published 21 Aug 2026) - [CVE-2026-61399: Apache CloudStack improper output encoding in Lock User UI](https://junglewise.ai/threats/cve-2026-61399-apache-cloudstack-improper-output-encoding-in-lock-user-ui) (medium, CVSS 4.8, published 21 Aug 2026) - [CVE-2026-61398: Apache CloudStack improper output encoding in password reset UI](https://junglewise.ai/threats/cve-2026-61398-apache-cloudstack-improper-output-encoding-in-password-reset-ui) (critical, CVSS 9.1, published 21 Aug 2026) - [CVE-2026-61397: Apache CloudStack sensitive information exposure in OAuth2 authentication](https://junglewise.ai/threats/cve-2026-61397-apache-cloudstack-sensitive-information-exposure-in-oauth2) (high, CVSS 7.5, published 21 Aug 2026) - [CVE-2026-59799: Apache CloudStack privilege management bypass in two-factor authentication](https://junglewise.ai/threats/cve-2026-59799-apache-cloudstack-privilege-management-bypass-in-two-factor) (high, CVSS 8.8, published 21 Aug 2026) - [CVE-2026-59780: Apache CloudStack information disclosure in LDAP authentication plugin](https://junglewise.ai/threats/cve-2026-59780-apache-cloudstack-information-disclosure-in-ldap-authentication) (high, CVSS 7.5, published 21 Aug 2026) - [CVE-2026-59657: Apache CloudStack cleartext storage of sensitive information in AsyncJob](https://junglewise.ai/threats/cve-2026-59657-apache-cloudstack-cleartext-storage-of-sensitive-information-in) (high, CVSS 7.5, published 21 Aug 2026) - [CVE-2026-59655: Apache CloudStack OAuth authentication information disclosure](https://junglewise.ai/threats/cve-2026-59655-apache-cloudstack-oauth-authentication-information-disclosure) (high, CVSS 7.5, published 21 Aug 2026) - [CVE-2026-59085: Apache CloudStack SSRF in webhook module](https://junglewise.ai/threats/cve-2026-59085-apache-cloudstack-ssrf-in-webhook-module) (critical, CVSS 9.1, published 21 Aug 2026) - [CVE-2026-50222: Apache CloudStack missing authorization in userdata APIs](https://junglewise.ai/threats/cve-2026-50222-apache-cloudstack-missing-authorization-in-userdata-apis) (high, CVSS 7.5, published 21 Aug 2026) - [CVE-2026-50112: Apache CloudStack RCE via metalink URL validation bypass](https://junglewise.ai/threats/cve-2026-50112-apache-cloudstack-rce-via-metalink-url-validation-bypass) (high, CVSS 8.8, published 21 Aug 2026) - [CVE-2026-47359: Apache CloudStack OS command injection in NAS backup plugin](https://junglewise.ai/threats/cve-2026-47359-apache-cloudstack-os-command-injection-in-nas-backup-plugin) (high, CVSS 8.8, published 21 Aug 2026) - [CVE-2026-25199: Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants. This…](https://junglewise.ai/threats/cve-2026-25199-instances-deployed-via-the-proxmox-extension-allow-unauthorized) (critical, CVSS 9.1, published 8 May 2026) - [CVE-2026-25077: Account users are allowed by default to register templates to be downloaded directly to the primary storage for…](https://junglewise.ai/threats/cve-2026-25077-account-users-are-allowed-by-default-to-register-templates-to-be) (high, CVSS 8.8, published 8 May 2026) - [CVE-2025-66467: Apache CloudStack incomplete cleanup in MinIO bucket deletion](https://junglewise.ai/threats/cve-2025-66467-apache-cloudstack-incomplete-cleanup-in-minio-bucket-deletion) (high, CVSS 8, published 8 May 2026) - [CVE-2025-66172: The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated…](https://junglewise.ai/threats/cve-2025-66172-the-cloudstack-backup-plugin-has-an-improper-access-logic-in) (high, CVSS 8.1, published 8 May 2026) - [CVE-2025-66171: Apache CloudStack improper access control in Backup plugin](https://junglewise.ai/threats/cve-2025-66171-apache-cloudstack-improper-access-control-in-backup-plugin) (medium, CVSS 6.5, published 8 May 2026) ## Most severe Apache CloudStack vulnerabilities - [CVE-2026-59085: Apache CloudStack SSRF in webhook module](https://junglewise.ai/threats/cve-2026-59085-apache-cloudstack-ssrf-in-webhook-module) (critical, CVSS 9.1, published 21 Aug 2026) - [CVE-2026-61398: Apache CloudStack improper output encoding in password reset UI](https://junglewise.ai/threats/cve-2026-61398-apache-cloudstack-improper-output-encoding-in-password-reset-ui) (critical, CVSS 9.1, published 21 Aug 2026) - [CVE-2026-62440: Apache CloudStack improper access control in Kubernetes Service plugin](https://junglewise.ai/threats/cve-2026-62440-apache-cloudstack-improper-access-control-in-kubernetes-service) (critical, CVSS 9.1, published 21 Aug 2026) - [CVE-2026-25199: Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants. This…](https://junglewise.ai/threats/cve-2026-25199-instances-deployed-via-the-proxmox-extension-allow-unauthorized) (critical, CVSS 9.1, published 8 May 2026) - [CVE-2026-61400: Apache CloudStack command injection in diagnostics API](https://junglewise.ai/threats/cve-2026-61400-apache-cloudstack-command-injection-in-diagnostics-api) (high, CVSS 8.8, published 21 Aug 2026) - [CVE-2026-47359: Apache CloudStack OS command injection in NAS backup plugin](https://junglewise.ai/threats/cve-2026-47359-apache-cloudstack-os-command-injection-in-nas-backup-plugin) (high, CVSS 8.8, published 21 Aug 2026) - [CVE-2026-50112: Apache CloudStack RCE via metalink URL validation bypass](https://junglewise.ai/threats/cve-2026-50112-apache-cloudstack-rce-via-metalink-url-validation-bypass) (high, CVSS 8.8, published 21 Aug 2026) - [CVE-2026-59799: Apache CloudStack privilege management bypass in two-factor authentication](https://junglewise.ai/threats/cve-2026-59799-apache-cloudstack-privilege-management-bypass-in-two-factor) (high, CVSS 8.8, published 21 Aug 2026) - [CVE-2026-25077: Account users are allowed by default to register templates to be downloaded directly to the primary storage for…](https://junglewise.ai/threats/cve-2026-25077-account-users-are-allowed-by-default-to-register-templates-to-be) (high, CVSS 8.8, published 8 May 2026) - [CVE-2026-68745: Apache CloudStack certificate validation bypass in SAML authentication](https://junglewise.ai/threats/cve-2026-68745-apache-cloudstack-certificate-validation-bypass-in-saml) (high, CVSS 8.1, published 21 Aug 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 20 | 3 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Apache technologies - [Apache Airflow](https://junglewise.ai/threats/technologies/airflow): 95 vulnerabilities - [Apache Camel](https://junglewise.ai/threats/technologies/camel): 87 vulnerabilities - [Apache Tomcat](https://junglewise.ai/threats/technologies/tomcat): 87 vulnerabilities - [Apache Thrift](https://junglewise.ai/threats/technologies/thrift): 77 vulnerabilities - [Apache Ofbiz](https://junglewise.ai/threats/technologies/ofbiz): 67 vulnerabilities - [Apache HTTP Server](https://junglewise.ai/threats/technologies/http-server): 62 vulnerabilities - [Apache Traffic Server](https://junglewise.ai/threats/technologies/traffic-server): 55 vulnerabilities - [Apache Brpc](https://junglewise.ai/threats/technologies/brpc): 36 vulnerabilities - [Apache Roller](https://junglewise.ai/threats/technologies/roller): 30 vulnerabilities - [Apache ActiveMQ](https://junglewise.ai/threats/technologies/activemq): 27 vulnerabilities - [Apache Apisix](https://junglewise.ai/threats/technologies/apisix): 27 vulnerabilities - [Apache Wicket](https://junglewise.ai/threats/technologies/apache-wicket): 23 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Apache CloudStack vulnerabilities", https://junglewise.ai/threats/technologies/cloudstack, 12 November 2026.