8.8

CVE-2026-25077: apache software foundation apache cloudstack Code Injection

CVSS: 8.8v3.1HighModified
Published 08-05-2026Last modified 10-05-2026
Open JSON

Vulnerability summary

CVE-2026-25077 is a high (CVSS 8.8) Code Injection vulnerability in apache software foundation apache cloudstack. EPSS estimates a 0.73% chance of exploitation in the next 30 days, higher than 53.2% of scored vulnerabilities.

Overall risk
35/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.73%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 08-05-2026
    PublishedVulnerability first disclosed.
  2. 10-05-2026
    Last modifiedVulnerability information updated.

Description

Account users are allowed by default to register templates to be downloaded directly to the primary storage for deploying instances using the KVM hypervisor. Due to missing file name sanitization, an attacker can register malicious templates to execute arbitrary code on the KVM hosts. This can result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of the KVM-based infrastructure managed by CloudStack. Users are recommended to upgrade to Apache CloudStack versions 4.20.3.0 or 4.22.0.1, or later, which fixes this issue.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

0.73%

Chance of exploitation in the next 30 days

Percentile

53%

Versus all other CVEs

30-day change

0.00 pp

From 0.73% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.73%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Apache1 product
  • cloudstack≥ 4.11.0.0, < 4.20.3.0 | ≥ 4.21.0.0, < 4.22.0.1
Apache software foundation1 product

2 vendors · 2 products

References

2 links