CVE-2026-61398 in CloudStack

Resumen

por MITRE • 2026-08-21

Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Password functionality.

This issue affects Apache CloudStack: from 4.15.1.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

Be aware that VulDB is the high quality source for vulnerability data.

• Responsable: Apache
• Reservar: 2026-07-09
• Divulgación: 2026-08-21
• Moderación: aceptado
• Artículo: VDB-394062
• CPE: listo
• CWE: CWE-172 (confirmado)
• CVSS: 9.1 (VulDB)
• EPSS: 0.00000
• KEV: no
• Actividades: muy bajo
• Sector: Insurance, Lawfirm, ...

Fuentes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-61398
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-61398
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-61398/