CVE-2026-61400
Received Received - Intake

Command Injection in Apache CloudStack

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: Apache Software Foundation

Description
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache CloudStack's run and get diagnostics functionality for the system VMs and virtual routers. An authenticated user holding the permissions required to invoke either `getDiagnosticsData` or `runDiagnostics` can achieve arbitrary command execution on the system VM and/or Virtual Router instances, with commands running as root (or as the diagnostics-process user, at minimum). This represents a full compromise of the affected instance and, depending on network segmentation, may provide a foothold for lateral movement within the CloudStack-managed infrastructure, including access to guest network traffic handled by the compromised Virtual Router. The getDiagnosticsData and runDiagnostics APIs are restricted to only Admin role accounts by default. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-61400
EUVD
EUVD-2026-63837

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
apache cloudstack From 4.20.0.0 (inc) to 4.20.3.0 (inc)
apache cloudstack From 4.21.0.0 (inc) to 4.22.1.0 (inc)
apache cloudstack 4.20.3.1
apache cloudstack 4.22.1.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a command injection vulnerability in Apache CloudStack affecting the run and get diagnostics functionality for system VMs and virtual routers. An authenticated admin user can execute arbitrary commands on these instances with root privileges, leading to full system compromise and potential lateral movement within the infrastructure.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized command execution attempts via the affected APIs. Monitor logs for suspicious calls to getDiagnosticsData or runDiagnostics by non-admin users. Inspect system VMs and virtual routers for unexpected processes or network activity.

Impact Analysis

An attacker with admin access could execute malicious commands on system VMs or virtual routers, gaining control over the CloudStack environment. This may allow access to guest network traffic and enable further attacks on the infrastructure.

Compliance Impact

This vulnerability allows authenticated admin users to execute arbitrary commands as root on system VMs and virtual routers, potentially leading to full compromise of the CloudStack instance. This could result in unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (healthcare data privacy) compliance requirements for data confidentiality and integrity.

Mitigation Strategies

Immediately upgrade Apache CloudStack to version 4.20.3.1, 4.22.1.1, or later. Ensure only Admin role accounts have access to getDiagnosticsData and runDiagnostics APIs. Review logs for past exploitation attempts and isolate affected system VMs or virtual routers if compromise is suspected.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61400. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart