CVE-2026-61400

Apache CloudStack: Get and Run Diagnostics Command Injection

Published Aug 21, 2026 CVSS 3.1 · 8.8 High EPSS 2.9% KEV · Not listed

Description

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache CloudStack's run and get diagnostics functionality for the system VMs and virtual routers.

An authenticated user holding the permissions required to invoke either `getDiagnosticsData` or `runDiagnostics` can achieve arbitrary command execution on the system VM and/or Virtual Router instances, with commands running as root (or as the diagnostics-process user, at minimum). This represents a full compromise of the affected instance and, depending on network segmentation, may provide a foothold for lateral movement within the CloudStack-managed infrastructure, including access to guest network traffic handled by the compromised Virtual Router.

The getDiagnosticsData and runDiagnostics APIs are restricted to only Admin role accounts by default.

This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

Analysis

Technical impact

Apache CloudStack permits authenticated administrators to invoke getDiagnosticsData or runDiagnostics APIs. Because these endpoints fail to neutralize special elements properly, they are vulnerable to command injection. An attacker with administrative privileges can execute arbitrary shell commands on the underlying system VM or virtual router as root or the diagnostics-process user, granting full control over the instance and potential lateral movement within the CloudStack environment.

Affected Systems

Apache CloudStack versions 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 are affected. All builds within these version ranges contain the vulnerability. The issue is limited to API endpoints that require administrator permissions.

Risk and Exploitability

The high CVSS score of 8.8 reflects the impact of arbitrary command execution as root. The EPSS score is 3%, indicating a moderate probability of exploitation. This vulnerability is not listed in the CISA KEV catalog. The vulnerability is exploitable via the management server’s API, over the network. The likely attack vector is an authenticated API call to getDiagnosticsData or runDiagnostics, as inferred from the description. An attacker with administrative privileges could execute commands on system VMs or virtual routers. Based on the description, it is inferred that environments with shared or weak admin credentials would be at increased risk.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apache Software Foundation

Apache CloudStack

unaffected

Version	Status	Constraints
`4.14.0.0`	affected	≤ 4.20.3.0
`4.21.0.0`	affected	≤ 4.22.1.0

Configuration 1 [-]

OR	cpe:2.3:a:apache:cloudstack::::::::
	cpe:2.3:a:apache:cloudstack::::::::

No data.

Vendor Product Versions

Apache

Cloudstack

Version	Status	Scheme	Platform
`[4.14.0.0,4.20.3.0]`	affected	generic	—
`[4.21.0.0,4.22.1.0]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Apache CloudStack to version 4.20.3.1, 4.22.1.1, or any later release that contains the fix for the command injection vulnerability.
If an immediate upgrade cannot be performed, limit access to the getDiagnosticsData and runDiagnostics APIs to only the accounts that absolutely require them, and consider disabling these endpoints for non-administrator roles.
Enforce strict role-based access control and ensure that only trusted administrators possess the permission to invoke diagnostics, thereby reducing the attack surface.

Generated by OpenCVE AI on September 24, 2026 at 22:52 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 2.9% (2.907% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc

History

Aug 27, 2026 2:45 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:apache:cloudstack::::::::

Aug 21, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 21, 2026 10:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apache Apache cloudstack
Vendors & Products		Apache Apache cloudstack

Aug 21, 2026 8:45 AM Description updated. Title updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache CloudStack's run and get diagnostics functionality for the system VMs and virtual routers. An authenticated user holding the permissions required to invoke either `getDiagnosticsData` or `runDiagnostics` can achieve arbitrary command execution on the system VM and/or Virtual Router instances, with commands running as root (or as the diagnostics-process user, at minimum). This represents a full compromise of the affected instance and, depending on network segmentation, may provide a foothold for lateral movement within the CloudStack-managed infrastructure, including access to guest network traffic handled by the compromised Virtual Router. The getDiagnosticsData and runDiagnostics APIs are restricted to only Admin role accounts by default. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Title		Apache CloudStack: Get and Run Diagnostics Command Injection
Weaknesses		CWE-77
References		https://lists.apache.org/thread/g6cwddtjrwbh1d56wjz4cfp3fzfm4kbc